{"id":"87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180","title":"Change PowerShell Policies to an Insecure Level","description":"Detects changing the PowerShell script execution policy to a potentially insecure level using the \"-ExecutionPolicy\" flag.","author":"frack113","status":"test","level":"medium","date":"2021-11-01","modified":"2025-10-07","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Administrator scripts"],"references":["https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4","https://adsecurity.org/?p=2604","https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml","source_sha256":"6fde98ed6d74d24b62f202e8e39e933a3fd396a292b6834ab06c4ecef1ccf5be","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Change PowerShell Policies to an Insecure Level\nid: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180\nrelated:\n    - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f # ProcCreation Registry\n      type: similar\n    - id: 61d0475c-173f-4844-86f7-f3eebae1c66b # ScriptBlock\n      type: similar\n    - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 # Registry\n      type: similar\nstatus: test\ndescription: Detects changing the PowerShell script execution policy to a potentially insecure level using the \"-ExecutionPolicy\" flag.\nreferences:\n    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4\n    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4\n    - https://adsecurity.org/?p=2604\n    - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/\nauthor: frack113\ndate: 2021-11-01\nmodified: 2025-10-07\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_img:\n        - OriginalFileName:\n              - 'powershell_ise.exe'\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n        - Image|endswith:\n              - '\\powershell_ise.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n    selection_option:\n        CommandLine|contains:\n            - '-executionpolicy '\n            - ' -ep '\n            - ' -exec '\n    selection_level:\n        CommandLine|contains:\n            - 'Bypass'\n            - 'Unrestricted'\n    filter_main_powershell_core:\n        ParentImage:\n            - 'C:\\Windows\\SysWOW64\\msiexec.exe'\n            - 'C:\\Windows\\System32\\msiexec.exe'\n        CommandLine|contains:\n            - '-NoProfile -ExecutionPolicy Bypass -File \"C:\\Program Files\\PowerShell\\7\\'\n            - '-NoProfile -ExecutionPolicy Bypass -File \"C:\\Program Files (x86)\\PowerShell\\7\\'\n    filter_optional_avast:\n        ParentImage|contains:\n            - 'C:\\Program Files\\Avast Software\\Avast\\'\n            - 'C:\\Program Files (x86)\\Avast Software\\Avast\\'\n            - '\\instup.exe'\n        CommandLine|contains:\n            - '-ExecutionPolicy ByPass -File \"C:\\Program Files\\Avast Software\\Avast'\n            - '-ExecutionPolicy ByPass -File \"C:\\Program Files (x86)\\Avast Software\\Avast\\'\n    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Administrator scripts\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180.json","kind":"sigma"}