Suspicious Base64 Encoded IP in PowerShell Execution

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects PowerShell script blocks that contain base64-encoded IP addresses, a technique commonly used for obfuscation and defense evasion. Threat actors may leverage this method to download and execute secondary payloads from IP addresses - often their command and control (C2) servers or other malicious infrastructure. By encoding these URLs in base64 within PowerShell commands, adversaries attempt to bypass detection mechanisms and evade user scrutiny. This rule helps identify suspicious activity where PowerShell is used to retrieve content from IPs via base64-encoded strings, which is rarely seen in legitimate software.

Internal Research

2026-02-04 00:00:00

None

089729f9-c122-4777-a7a0-1e8d863573a0

attack.defense-evasion attack.t1027 attack.command-and-control

Nextron Sigma feed only (private)