PowerShell: Set-ExecutionPolicy changed to Unrestricted or bypass

title: "PowerShell: Set-ExecutionPolicy changed to Unrestricted or bypass"
id: f42f1b6d-278c-410d-a978-23c85c9133ca
related:
  - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f
    type: similar
  - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
    type: similar
  - id: fad91067-08c5-4d1a-8d8c-d96a21b37814
    type: similar
  - id: 61d0475c-173f-4844-86f7-f3eebae1c66b
    type: derived
status: test
description: This rule flags PowerShell script content that invokes Set-ExecutionPolicy with insecure execution policy targets, specifically Unrestricted or bypass. Attackers may use these settings to reduce script execution restrictions and enable easier execution of malicious or unsigned PowerShell code. It relies on telemetry that captures ScriptBlockText for PowerShell execution and matches the cmdlet and policy values within the same script block, with an exception for specific Chocolatey installer download strings.
references:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
  - https://adsecurity.org/?p=2604
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml
author: frack113, Huntrule Team
date: 2021-10-20
modified: 2023-12-14
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains: Set-ExecutionPolicy
  selection_option:
    ScriptBlockText|contains:
      - Unrestricted
      - bypass
  filter_optional_chocolatey:
    ScriptBlockText|contains:
      - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')
      - (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Administrator script
level: medium
license: DRL-1.1