Run Commands Directly with PowerShell

Execute a PowerShell command non-interactively without entering a session:

powershell -c "$COMMAND"

-c is shorthand for -Command. The full form matters when scripting or debugging because the abbreviated flags accept prefixes — -c, -co, -com all resolve to -Command — which occasionally causes confusion when a typo silently matches a different parameter.

Useful companion flags

Flag	Effect
-Command / -c	Run the command string and exit
-EncodedCommand / -enc	Accept a Base64 (UTF-16LE) command — the standard obfuscation wrapper, and what most download cradles decode into
-NoProfile / -nop	Skip profile scripts — faster and avoids user profile side effects
-ExecutionPolicy Bypass / -ep bypass	Ignore the execution policy for this invocation (see powershell-execution-policy-bypass)
-WindowStyle Hidden / -w hidden	No console window — common in phishing payloads and scheduled tasks
-File	Run a script file instead of a command string

Operational notes

• powershell -c from a cmd.exe or run dialog is the simplest way to invoke one-liners; pwsh -c does the same for PowerShell 7+.
• Logging matters here: with Script Block Logging enabled, the command text lands in event 4104 regardless of whether it came in via -Command, -EncodedCommand, or -File — see windows-event-logs and get-winevent for the query side.
• The -enc pattern is so strongly associated with offensive tradecraft that many EDRs flag powershell.*-e(nc)?\s on command line alone; attackers have moved to download cradles that decode at runtime (see invoke-webrequest-download-cradles).
• For a fully working payload, -Command strings that spawn network callbacks are the transport behind powershell-reverse-shell and the ephemeral-service pattern in wmi-remote-service-execution.

Sources

• about_PowerShell_exe
• about_Logging_Windows

Related: powershell-execution-policy-bypass, powershell-reverse-shell, invoke-webrequest-download-cradles