Command line analysis
What to look for: inspection
Common Obfuscation Techniques used to make code, commands, or data difficult to understand or detect, used both by attackers and legitimately for IP protection. patterns observed in frameworks like PowerShell A command-line shell and scripting language built on the .NET framework, commonly used for system administration and potentially for malicious purposes. Empire and Cobalt Strike Legitimate post-exploitation tool widely abused for C2, lateral movement, and credential harvesting. Beaconing, fileless injection, encrypted comms. Pirated and cracked versions used by APTs, ransomware gangs, and commodity malware. Frequently paired with TrickBot or BazarLoader to coordinate ransomware deployment. :
Base64 encoding
powershell.exe -EncodedCommand <long-base64-string>The encoded blob hides the actual command from plain-text matching. The decode workflow below turns it back into readable intent.
Caret insertion
cmd.exe /c e^ch^o “Hello”cmd strips the escape carets before execution, so the command runs normally while breaking naive substring signatures. Interior quotes (w”h”oami) work the same way.
Variable expansion
$env:COMSPECUses environment variables to mask binary references. cmd can even assemble strings from variable substrings (%COMSPEC:~-7,1% extracts a single letter), so the payload never appears literally.
Adversaries also abuse trusted system binaries: LOLBins Living Off the Land Binaries: trusted, signed system executables (certutil, rundll32, mshta) weaponized so the malicious part is the argument line, not the file on disk. The evasion face of the Living Off The Land technique covered under Execution. such as certutil.exe for downloads, regsvr32.exe for DLL execution, bitsadmin.exe for transfers. These leave minimal forensic footprint because the binary itself is signed and trusted.
Educational, not operational
The examples in this chapter are illustrative. We deliberately do not show fully working invocation strings. Analysts need to recognize the shape of adversary technique, not have a copy-pasteable cookbook. Decoding what an attacker already ran is defensive analysis, and everything below stays on that side of the line. If you need to test detections, use isolated lab environments and sanctioned red-team tools.
The decode workflow
The single most common parsing task this page exists for: an alert hands you powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQA... and the verdict depends on what that blob says. It is encoding, not encryption. There is no key. It decodes locally in seconds, if you know the one gotcha.
Extract the blob
Copy the Base64 string out of the alert into a local decoder. Never paste it into a terminal that could execute it, and never run the command to “see what it does.” CyberChef running locally in a browser tab is the standard tool.
Decode Base64, then interpret as UTF-16LE
This is the gotcha that trips every junior once: -EncodedCommand takes Base64 of UTF-16LE text, because that is what Windows means by “Unicode.” Decode it as UTF-8 and you get the characters interleaved with null bytes (I·E·X· ·(·N·e·w), which some tools render as gibberish or CJK characters. In CyberChef the recipe is From Base64 followed by Decode Text (UTF-16LE). If your output has a space or dot between every letter, you skipped the second step.
Read the result, and expect another layer
The example blob above opens with IEX (New-Object …, the classic download-and-execute-in-memory cradle. Real payloads often nest: the decoded text itself calls FromBase64String plus a Gzip or Deflate decompress, then IEX again. Keep unwinding layers in the decoder until you reach readable intent, and record each layer in your notes.
Treat what falls out as hot
URLs, domains, and IPs inside the decoded payload are live attacker infrastructure until proven otherwise. Do not browse them to check. They are IoCs: record them, look them up in Threat Intelligence Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, implications, and actionable advice. , and pivot on them in the network telemetry.
The flags do not spell themselves out
PowerShell accepts abbreviated parameter prefixes: -e, -en, and -enc all resolve to -EncodedCommand, even though -ExecutionPolicy shares the -e prefix. A detection or a triage search that string-matches the full flag name misses every abbreviated form, which is exactly why attackers abbreviate. Parse by meaning, not by literal string.
-EncodedCommand-e, -en, -enc, -ecPayload is Base64 of UTF-16LE. Decode it.-NoProfile-nopSkips profile scripts for a clean, fast, unmonitored-feeling start. Common in automation and in attacks alike.-WindowStyle Hidden-w hidden, -win hNo visible window. Legitimate scheduled scripts use it; so does nearly all malware.-NonInteractive-noniNo prompt back to a human. Expected from services, notable from a user session.-ExecutionPolicy Bypass-ep bypass, -exec bypassDisables script-execution restrictions for this process. Not an exploit (the policy is not a security boundary), but a strong tell of unmanaged script execution.No single flag is a verdict. -nop -w hidden -enc together on a workstation, spawned from an Office process, is a very different sentence than the same flags in a signed vendor scheduled task. The combination plus the context decides, and the decoded payload settles it.
When there is no command line to parse
Sometimes the alert’s command-line field is simply empty. The most common reason is not evasion; it is configuration. Windows Security Event 4688 records process creations, but its CommandLine field populates only when the “Include command line in process creation events” policy is enabled, and it is off by default. If it was never turned on, every historical event is blank and there is no retroactive fix.
Know your source
Security 4688 without the policy: no command line. Sysmon Windows service that produces rich endpoint telemetry, process creation, network connections, file events, for SIEM ingestion. Event ID 1: full command line, parent, and hashes by default. EDR process telemetry: almost always captures it. Which source feeds your console determines what you can parse.
An empty field is a fact about telemetry
Record “command line not captured (4688 policy disabled)” rather than “no command line,” and pivot to the sources that do have it. Absence of the field is a visibility gap, not evidence the process ran without arguments.
Execution context
The same command can be benign or malicious depending on context. Four contextual signals matter most:
NT AUTHORITY\SYSTEM vs. a standard user account. System-level execution from a user-initiated process is rarely legitimate.
Outside business hours vs. scheduled maintenance window. Cross-reference with change tickets and the user’s known patterns.
cmd.exe spawned by outlook.exe is suspicious. The same command from Task Scheduler is usually legitimate.
C:\Windows\Temp or %APPDATA% is suspicious. C:\Program Files is expected.
Example: PowerShell from Outlook
A PowerShell script launched by Outlook signals likely macro Execution The attacker successfully runs malicious code on a system, typically using interpreters, scripts, payloads, or legitimate tools. from an email attachment. What you would check next:
- The Outlook session’s recent attachment activity.
- The script’s Command Line In SOC analysis, the argument string a process was launched with. Often the load-bearing forensic field on an EDR alert because it reveals what the process was actually told to do. for download cradle patterns.
- Outbound network activity from PowerShell in the next 60 seconds.
- Whether the User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. ‘s mailbox shows similar emails to other recipients.
The same PowerShell command from Task Scheduler during a maintenance window is almost certainly legitimate. Same command, different parent, different verdict.
Beyond PowerShell and cmd
The same analysis transfers off Windows; only the vocabulary changes.
macOS and Linux pipes. curl … | sh and echo <base64> | base64 -d | bash are the download cradle and the encoded command of the Unix world. osascript -e running AppleScript from a non-interactive parent is the macOS counterpart of an Office macro spawning a shell.
Vendor-standard noise to recognize. Electron apps launch helpers with flags like —type=utility or —type=renderer. The Alert worked example’s Case B command line is exactly this shape: long, odd-looking, and vendor-standard. Knowing the legitimate shapes is what keeps them from eating triage time.
Pattern recognition
Build mental patterns for atypical use of common binaries. These are the shapes you want to recognize before reading the command in detail.
Unusual LOLBin invocations. rundll32.exe, mshta.exe, wmic.exe, regsvr32.exe invoked outside their normal contexts.
Framework flags. Command-line flags that suggest framework use: -NoP, -EncodedCommand (or any prefix of it), -WindowStyle Hidden, -NonInteractive.
Indirect execution. A trusted binary loading attacker-controlled content from a remote location. The binary is legitimate. The payload is not.
Key Takeaway
Command Line Analysis The examination of command-line parameters, arguments, and execution context to understand process behavior and intent. is where Parsing Breaking a raw alert, log line, or command string into its component fields so each can be examined on its own: the user, the host, the action, the time. In triage, parsing the alert is the first move; the details that decide a verdict live in the fields, not in the alert name. becomes investigation. The decode workflow turns an encoded blob into readable intent, the flag table keeps abbreviations from hiding it, and the 4688 gap reminds you to know what your telemetry actually captured. What the command says, weighed against its context, anchors everything downstream.
Next up
Process relationships
Parent-child chains and lineage reconstruction. Macro execution, persistence, hollowing, token theft.
Read process relationships