F-002highwindows.encoded_powershell v0.1.0
PowerShell started with an encoded command
- E-065Command line in EV-000003
- E-066Base64 payload decoded by PastePile
Built for the evidence.
Drop theevidence.Build the case.
Turn the exports you have into a case you can stand behind. Findings with proof. Gaps made clear. A next step you can act on.
An incident evidence workbench.
For MSPs and lean security teams.
From the real demo caseC-0001 / Synthetic evidence
endpoint-telemetry.csv
Original preserved. Every record traceable.
Evidence-backed finding
F-002High severity
PowerShell.
Encoded command.
A record to prove it.
WINWORD.EXE started PowerShell with a base64 command on WS-4471.
CitesE-065E-066
Not established
Whether the decoded command ran successfully.
67 evidence recordsOne defensible case
Every conclusion has a paper trail Evidence in. Clarity out.
The work your client receives
From scattered exports
to a report you can explain.
Bring the evidence together, review the findings, and hand over a case with its sources attached. Built for MSPs doing the investigation and the client write-up.
Read the sample reportSynthetic evidence. Real product workflow. No account or card needed.
Client handoverC-0001 / DEMO
Office document to encoded PowerShell
- Evidence received
- 22 records from a Defender export.
- Findings to review
- 3 findings with citations back to the evidence.
- Questions still open
- 3 stated unknowns, kept visible in the report.
- Ready for handover
- Scope, supported findings, open questions and recommended next steps.
A preview of the sample case, not a customer outcome.
02 / Evaluate
Measure your own workflow.
Use a familiar case. Compare investigation and report preparation time with your current process.
03 / Review
Bring your requirements.
Review security, subprocessors and capacity and retention before deciding.
02Why this exists
The answer matters. So does the proof.
You do the investigation. PastePile keeps the evidence, the conclusions, and the unanswered questions connected.
Show the proof.
When a client asks where a conclusion came from, point to the record. Every finding keeps its evidence attached.
No evidence, no finding.
Make the gaps visible.
A missing export or a check that could not run belongs in the answer. What was not assessed is never presented as safe.
Unknown remains unknown.
Keep a theory a theory.
A hypothesis stays separate from a finding, with the evidence that would support or refute it written down.
Hypothesis is not finding.
03Raw evidence to defensible case
Watch a conclusion get built
Follow a Defender export from the original file to a finding with evidence behind it. Scroll to see the case take shape.
01Classify and parse
A file arrives, and PastePile works out what it is
The export is identified by its contents and hashed on arrival. Every parsed record keeps its source and parser version, so you can check where it came from.
02Extract
Every host, account, process and destination is named
Hosts, accounts, processes and destinations are connected to the records that name them. Follow a connection back to the evidence.
03Detect and prove
A detector concludes, and cites what it concluded from
The encoded PowerShell finding cites its two supporting evidence records. Review the rule, severity and confidence alongside the proof.
04State the gap, compile the hunt
And then it says what it still does not know
Did the command succeed? This export cannot establish that. The gap stays visible, with a hunt query you can review and run in your own console.
- Classify and parse
- Extract
- Detect and prove
- State the gap, compile the hunt
A-001endpoint-telemetry.csv
2026-08-24T09:12:44Z,WS-4471,r.okafor,explorer.exe,OUTLOOK.EXE,"OUTLOOK.EXE" 2026-08-24T09:14:02Z,WS-4471,r.okafor,OUTLOOK.EXE,WINWORD.EXE,"WINWORD.EXE /n C:\Users\r.okafor\Downloads\Remittance_Advice_44718.docm" 2026-08-24T09:14:09Z,WS-4471,r.okafor,WINWORD.EXE,powershell.exe,"powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAo…" 2026-08-24T09:14:11Z,WS-4471,r.okafor,powershell.exe,,"cdn-updates.example:443"
- EV-00000109:12:44explorer.exe started OUTLOOK.EXE
- EV-00000209:14:02OUTLOOK.EXE started WINWORD.EXE
- EV-00000309:14:09WINWORD.EXE started powershell.exe
- EV-00000409:14:11powershell.exe connected to cdn-updates.example
- hostWS-4471
- accountr.okafor
- processpowershell.exe
- domaincdn-updates.example
Not established by this evidence
Whether the decoded command executed successfully, or what it did next.
HUNT-001 · Microsoft Defender XDR (KQL) · not executed
DeviceProcessEvents
| where InitiatingProcessFileName =~ @'WINWORD.EXE'
and FileName =~ @'powershell.exe'04Unknown is a feature
Know where the evidence stops.
Missing telemetry. Unassessed checks. An outcome the records cannot establish. The gaps are part of the answer.
The evidence chain runs from EV-000003 to E-065 to F-002 and then stops. Whether the decoded command executed is not established by this evidence. HUNT-001 is the hunt that would close the gap.
Not established
Which document, add-in or macro caused the launch. The process record does not carry it; that needs the file, or the user's account of it.
F-001
Not established
Whether the created task or service actually ran. Process-creation evidence alone does not show it.
F-003
Not assessed
Two account checks could not run. They need sign-in logs, and no sign-in logs were in the evidence.
account.failure_burst_then_success account.unusual_signin_hour
Not enriched
Two external indicators appear in the evidence. No reputation lookup has been performed, because PastePile only does that on your instruction.
N-0007 N-0008
C-0001 ran 13 checks and could not run 21. Both numbers are on the overview. Not assessed is never presented as safe, and a parser that failed is never presented as clean.
05From finding to next hunt
Take the next question to your console.
Go from a finding to a hypothesis to a compiled hunt. You choose when to run it, in the tools you already use.
findingF-001
winword.exe started powershell.exe
Office applications do not normally launch command interpreters. The finding cites the two process-creation records that show it.
hypothesisH-001
The same document reached other mailboxes
Supported if another host runs the same parent and child pair in the same window. Refuted if thirty days of process telemetry show it nowhere else.
huntHUNT-001
A query you run where the telemetry lives
PastePile compiles it for Defender, Sentinel, Splunk, Elastic and Sigma, and hands it to you. It has no path to your tenant and never runs it.
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ @'WINWORD.EXE'
and FileName =~ @'powershell.exe'
| project Timestamp, DeviceName, AccountName,
InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp asc06MSP workflow
Your investigation. Ready to hand over.
Organize cases by client. Deliver a report that shows what you received, what you found, what is still unknown, and what comes next.
C-0001Client AClient report
Office document to encoded PowerShell
- What was received
- 22 records from one Defender export, hashed on arrival.
- What was found
- 3 findings, each citing the records that support it.
- What is not established
- 3 stated unknowns, in their classes, none presented as safe.
- What to do next
- Recommended next steps, with unresolved questions kept visible.
Client-facing HTML, with findings and open questions kept separate.
- 01
Receive
A client sends the export they have. Drop it in, pick the client, name the case or let the evidence name it.
- 02
Read
The overview separates findings, stated unknowns and recommended actions. Findings cite their supporting records.
- 03
Hand on
Copy the compiled hunt into the client's own tooling. Export the report with every citation intact.
- 04
Close
Case records and original uploads have different retention windows. Scheduled deletion is audited; backup copies follow a separate cleanup process described in Privacy.
07The boundary
Fits the work. Respects the boundaries.
An evidence workbench between the exports you have and the security platforms you already run.
It is
An evidence workbench for the exports a Microsoft-centered practice can already produce. It reads Windows Security and Sysmon EVTX, Microsoft Defender and Entra CSV exports, .eml messages, syslog, JSON, delimited text and indicator lists, and it records the parser and version that read each one. It builds a timeline, cites the record behind every finding, states what the evidence does not establish, and writes the report a client can act on.
It is not
Not a SIEM, an EDR, an MDR or a SOAR: it runs no agent, watches nothing live, and has no path into your tenant. Not a threat-intelligence platform, because reputation is context and never truth. Not a chatbot. A model is handed findings that already exist, never raw artifacts, and it may reorder them and pick from a fixed set of codes. There is no field it can write a sentence into.
Optional AI and enrichment show what will be sent before confirmation. Infrastructure processing, storage and backups are described on the security and privacy pages. PastePile is under active development: do not upload classified information, Controlled Unclassified Information (CUI), export-controlled information, or data you are not authorized to share with PastePile.
Getting started
Start with the demo case.
It is synthetic evidence run through the real pipeline: every reference on this page is in it. The pricing page has the plans and what each one includes.
Drop the evidence. Build the case.