Sigma rule: Potential PowerShell Execution Policy Tampering

Rule

Title

Potential PowerShell Execution Policy Tampering

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-01-11

Modified

2023-12-14

File

rules/windows/registry/registry_set/registry_set_powershell_execution_policy.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|endswith:
        # Note for future readers: For PowerShell 7+ the ExecutionPolicy is handled via a setting file due to the fact that PWSH7 is available for mac and linux
        # Attackers can create a per-user setting file (powershell.config.json) and set the execution policy there
        # Learn more here: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_config?view=powershell-7.3
        - '\ShellIds\Microsoft.PowerShell\ExecutionPolicy'
        - '\Policies\Microsoft\Windows\PowerShell\ExecutionPolicy'
    Details|contains:
        - 'Bypass'
        - 'Unrestricted'
filter_main_svchost:
    # Note: We filter out "svchost" to avoid FP with changes using "gpedit" for example.
    Image|contains:
        - ':\Windows\System32\'
        - ':\Windows\SysWOW64\'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.defense-impairment

Related rules

• cf2e938e-9a3e-4fe8-a347-411642b28a9f (similar)
• 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 (similar)
• 61d0475c-173f-4844-86f7-f3eebae1c66b (similar)

References

• https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_powershell_execution_policy.yml