Decoding a PowerShell -EncodedCommand During Incident Response (the UTF-16 gotcha)

You're triaging an alert. Scheduled task, weird parent process, and a command line that looks like this: powershell.exe -nop -w hidden -enc JABjACAAPQAg... You know the drill: grab the Base64 blob, de...