From cf9411f7214df8efeb23604cab744eddae4c0247 Mon Sep 17 00:00:00 2001 From: Eric Conrad Date: Fri, 29 Oct 2021 16:37:26 -0400 Subject: [PATCH] Added another base64 encoding method --- DeepBlue.ps1 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/DeepBlue.ps1 b/DeepBlue.ps1 index b9a8e63..5e6abb4 100644 --- a/DeepBlue.ps1 +++ b/DeepBlue.ps1 @@ -692,6 +692,9 @@ function Check-Command(){ if ($commandline -Match "\-enc.*[A-Za-z0-9/+=]{100}"){ $base64= $commandline -Replace "^.* \-Enc(odedCommand)? ","" } + ElseIf ($commandline -Match "\-En.*[A-Za-z0-9/+=]{100}"){ + $base64= $commandline -Replace "^.* \-En","" + } ElseIf ($commandline -Match ":FromBase64String\("){ $base64 = $commandline -Replace "^.*:FromBase64String\(\'*","" $base64 = $base64 -Replace "\'.*$",""