Sigma Rule Library

PowerShell Script Execution Policy Enabled

Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

View on GitHubOpen raw file

Detection logic

selection

TargetObject|endswith: \Policies\Microsoft\Windows\PowerShell\EnableScripts
Details: DWORD (0x00000001)

Condition

selection

Raw YAML

title: PowerShell Script Execution Policy Enabled
id: 8218c875-90b9-42e2-b60d-0b0069816d10
related:
    - id: fad91067-08c5-4d1a-8d8c-d96a21b37814
      type: derived
status: test
description: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
references:
    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
date: 2023-10-18
tags:
    - attack.execution
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Policies\Microsoft\Windows\PowerShell\EnableScripts'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Likely
level: low

False positives

  • Likely

References

Related rules

Similar rules

Blue Mockingbird - Registry

high

windows · Same logsource category (registry_set)

Command Executed Via Run Dialog Box - Registry

low

windows · Same logsource category (registry_set)

CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

high

windows · Same logsource category (registry_set)

CVE-2021-31979 CVE-2021-33771 Exploits

critical

windows · Same logsource category (registry_set)