🎯 Encoded PowerShell command execution

The items that name it 3

• Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)
  writeup2026-02-08It is written here as Encoded PowerShell command execution (powershell.exe -ExecutionPolicy Unrestricted -encodedCommand).

  powershell.exe -ExecutionPolicy Unrestricted -encodedCommand

• Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?
  writeup2025-11-20

  Threat actor ran base64-encoded PowerShell commands (powershell.exe -ExecutionPolicy Unrestricted -encodedCommand ...) as child processes of Velociraptor.exe

• Cleo Software Actively Being Exploited in the Wild | Huntress
  advisory2025-01-06

  Decoded PowerShell command reaches out to an external IP address to retrieve new JAR files for continued post-exploitation.