Function checkEncodedCommand

src/tools/PowerShellTool/powershellSecurity.ts:166–180

* Checks for encoded command parameters which obscure intent. * These are commonly used in malware to bypass security tools.

(
  parsed: ParsedPowerShellCommand,
)

 * These are commonly used in malware to bypass security tools.
 */
function checkEncodedCommand(
  parsed: ParsedPowerShellCommand,
): PowerShellSecurityResult {
  for (const cmd of getAllCommands(parsed)) {
    if (isPowerShellExecutable(cmd.name)) {
      if (psExeHasParamAbbreviation(cmd, '-encodedcommand', '-e')) {
        return {
          behavior: 'ask',
          message: 'Command uses encoded parameters which obscure intent',
        }
      }
    }
  }
  return { behavior: 'passthrough' }
}

/**
 * Checks for PowerShell re-invocation (nested pwsh/powershell process).