Sigma rule: Change PowerShell Policies to an Insecure Level - PowerShell

Rule

Title

Change PowerShell Policies to an Insecure Level - PowerShell

Status

test

Level

medium

Author

frack113

Date

2021-10-20

Modified

2023-12-14

File

rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

selection_cmdlet:
    ScriptBlockText|contains: 'Set-ExecutionPolicy'
selection_option:
    ScriptBlockText|contains:
        - 'Unrestricted'
        - 'bypass'
filter_optional_chocolatey:
    ScriptBlockText|contains:
        - "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')"
        - "(New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')"
condition: all of selection_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Administrator script

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

Related rules

• cf2e938e-9a3e-4fe8-a347-411642b28a9f (similar)
• 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 (similar)
• fad91067-08c5-4d1a-8d8c-d96a21b37814 (similar)

References

• https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
• https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
• https://adsecurity.org/?p=2604

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml