CyberChef for SOC analysts: decoding what attackers hide

Sooner or later every SOC analyst meets a string that makes no sense: a PowerShell command followed by hundreds of random-looking characters, a link wrapped three times by email security, a hex blob in a log. Attackers rely on that confusion. Obfuscation slows analysts down and lets malware slip past tools that look for known strings.

CyberChef is a free tool, published by the UK's GCHQ, built for exactly this. It offers hundreds of small operations (decode Base64, decompress, extract URLs, and so on) that you chain together into a recipe. This guide covers the handful of operations and recipes that solve most day-to-day SOC problems.

The interface in one minute

CyberChef has four areas:

Operations (left): a searchable list of everything it can do.
Recipe (middle): the operations you dragged in, applied from top to bottom.
Input (top right): the data you are working on.
Output (bottom right): the result, updated as you type.

Search for an operation, drag it into the recipe, paste your data into the input, and read the output. If the result is still unreadable, add another operation underneath. That is the whole workflow.

Recipe 1: decode an encoded PowerShell command

PowerShell's -EncodedCommand (often shortened to -enc or -e) takes a script encoded in Base64. Because PowerShell encodes text as UTF-16LE, every character is followed by an empty byte, so decoding the Base64 alone produces text with dots or gaps between the letters.

Paste only the encoded part
Copy the long string after -enc, without the rest of the command line, into the input.
Add From Base64
Drag From Base64 into the recipe. The output now shows readable letters separated by empty bytes.
Add Decode text
Drag Decode text below it and set the encoding to UTF-16LE (1200). The output is now the original script.

Read the result, but never run it. If the decoded script contains another long Base64 string, repeat the recipe on that string. Layers are common.

When the decoded script contains compressed data

A frequent second layer looks like FromBase64String(...) combined with GzipStream or DeflateStream inside the decoded script. That means the inner blob is Base64-encoded compressed data. Copy the inner string and use From Base64 followed by Gunzip (for GzipStream) or Raw Inflate (for DeflateStream).

Recipe 2: unwrap a rewritten link

Email security products rewrite links so they can check them when clicked. In a reported phishing email, the real destination is often buried inside a long URL with parameters such as url=https%3A%2F%2F....

URL Decode turns %3A%2F%2F back into :// so you can read the real address.
Extract URLs lists every URL in the input, which helps when the original link is nested inside another one.

Recipe 3: pull indicators out of raw text

Email headers, alert descriptions and log exports mix useful indicators of compromise with noise. Paste the whole block into the input and use:

Extract IP addresses
Extract domains
Extract URLs

Each returns a clean list you can search across your SIEM or check against threat intelligence. Add Sort and Unique to remove duplicates.

Before you paste an indicator into a ticket, chat or report, defang it so nobody can click it by accident and no tool turns it into a live link. Defang URL rewrites https://evil.example/login as hxxps[://]evil[.]example/login, and Defang IP Addresses does the same for IP addresses. When you need the working value again, Fang URL reverses the process.

When you do not know the encoding

The Magic operation tries common decodings automatically and suggests the ones that produce readable output. It is a good first step with an unknown string, but treat its suggestion as a hint: confirm it by building the recipe yourself, so you know exactly which layers were there.

Other operations that come up often:

From Hex: for strings such as 68747470733a2f2f.
From Charcode: for scripts that build text from character numbers, a common trick in JavaScript and PowerShell.
XOR: for simple single-byte XOR encoding, often seen in malware configuration data.

Save the recipes you reuse

Once a recipe works, save it (Save recipe in the recipe area) and keep a short library: PowerShell decode, link unwrap, IOC extraction, defang. A shared team library turns a five-minute puzzle into a five-second task, and makes everyone decode things the same way.

Why it matters for a SOC analyst

Encoded commands and wrapped links are where attackers hide intent, and an analyst who cannot read them has to guess. With a few CyberChef recipes you can see what a fileless PowerShell command actually does, find where a phishing link really leads, and share indicators safely. It turns "this looks suspicious" into a specific, documented finding.