Why PowerShell -EncodedCommand Looks Garbled and How to Decode It Correctly

Security analysts responding to incidents often encounter PowerShell commands using the -EncodedCommand (-enc) flag, which passes a Base64-encoded script to the interpreter. A common source of confusion is that the encoding expects UTF-16LE bytes rather than UTF-8, meaning each ASCII character is stored as two bytes, producing visible spaces or null characters when decoded incorrectly. This UTF-16LE requirement is enforced by PowerShell itself, not a deliberate obfuscation technique by attackers. Analysts can decode such payloads correctly using built-in PowerShell methods or Python's utf-16-le decoder without executing the underlying command. If the decoded output begins with the bytes H4sI, the payload is gzip-compressed inside Base64 and must be further decompressed to reveal the actual script.