Encoded PowerShell

From logon to payload

After the failures comes a 4624 success, and then a 4688 process creation for powershell.exe with -enc — a base64-encoded command run with -w hidden so no window appears. That combination is a red flag in any environment:

awk -F, '$2==4624 || $2==4688' /srv/soc-data/windows/security.log

In the terminal

student@vulntech:~$ awk -F, '$2==4624 || $2==4688' /srv/soc-data/windows/security.log
2026-03-10T08:21:15Z,4624,An account was successfully logged on (type 3),jmorgan,203.0.113.66,,
2026-03-10T08:22:03Z,4688,A new process has been created,jmorgan,,C:\\Windows\\System32\\cmd.exe,cmd.exe /c whoami
2026-03-10T08:22:44Z,4688,A new process has been created,jmorgan,,C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe,powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBldA==

Attackers encode PowerShell to slip past simple keyword filters. As an analyst you note the account it ran as, then (in a later course) decode the payload to see what it did.