<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# PowerShell Deobfuscation — API Reference

## PowerShell Encoding/Decoding

### Base64 Encoded Commands

```bash
# Encode (for testing)
echo -n "IEX('test')" | iconv -t UTF-16LE | base64 -w 0

# Decode
echo "SQBFAFgAKAAnAHQAZQBzAHQAJwApAA==" | base64 -d | iconv -f UTF-16LE -t UTF-8
```

### PowerShell Command-Line Flags

| Flag | Aliases | Description |
|------|---------|-------------|
| `-EncodedCommand` | `-e`, `-enc`, `-ec` | Base64-encoded UTF-16LE command |
| `-ExecutionPolicy Bypass` | `-ep bypass` | Bypass execution policy |
| `-NoProfile` | `-nop` | Don't load profile |
| `-NonInteractive` | `-noni` | No interactive prompt |
| `-WindowStyle Hidden` | `-w hidden` | Hide window |
| `-Command` | `-c` | Execute command string |

## PSDecode Module

```powershell
Import-Module PSDecode
PSDecode -InputObject (Get-Content obfuscated.ps1 -Raw)
PSDecode -InputObject $encodedString -Verbose
```

## ScriptBlock Logging

### Enable

```powershell
# Via Group Policy or Registry
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
  -Name "EnableScriptBlockLogging" -Value 1
```

### Query Logs

```powershell
# Event ID 4104 = ScriptBlock creation
Get-WinEvent -FilterHashtable @{
    LogName = "Microsoft-Windows-PowerShell/Operational"
    Id = 4104
} | Select-Object TimeCreated, @{N="Script";E={$_.Properties[2].Value}}
```

## CyberChef Operations for PowerShell

| Operation | Use Case |
|-----------|----------|
| From Base64 | Decode `-EncodedCommand` |
| Decode text (UTF-16LE) | PowerShell string encoding |
| Gunzip | Decompress `GZipStream` payloads |
| Raw Inflate | Decompress `DeflateStream` payloads |
| XOR | Simple XOR obfuscation |
| Find/Replace | Resolve string replacements |

## Common Obfuscation Patterns

### Invoke-Expression Aliases
```powershell
IEX          # Standard alias
iex          # Case-insensitive
.('IEX')     # Dot-sourced string
& ('IEX')    # Call operator
$ExecutionContext.InvokeCommand.InvokeScript()  # Direct API
[ScriptBlock]::Create($code).Invoke()           # ScriptBlock creation
```

### Environment Variable Abuse
```powershell
# Using env vars to build strings
$env:comspec[4,15,25]-join''  # Builds 'iex' from cmd.exe path
```

## Python Deobfuscation Libraries

```python
# base64 — decode encoded commands
import base64
base64.b64decode(encoded_string)

# re — pattern matching for obfuscation
import re
re.sub(r"pattern", replacement, script)

# zlib — decompress deflate streams
import zlib
zlib.decompress(data, -zlib.MAX_WBITS)
```
