PowerShell: Set-ExecutionPolicy to Unrestricted or Bypass
Alerts when PowerShell sets execution policy to Unrestricted or bypass, indicating weakened script execution controls.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-10-20
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script content that contains the Set-ExecutionPolicy cmdlet along with insecure execution policy options such as Unrestricted or bypass. Changing execution policy can reduce script execution protections and may enable persistent or stealthy execution of malicious scripts. It relies on PowerShell script block logging telemetry that captures the ScriptBlockText value for the cmdlet and its specified options.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
- adsecurity.orghttps://adsecurity.org/?p=2604
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "PowerShell: Set-ExecutionPolicy to Unrestricted or Bypass"
id: f42f1b6d-278c-410d-a978-23c85c9133ca
related:
- id: cf2e938e-9a3e-4fe8-a347-411642b28a9f
type: similar
- id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
type: similar
- id: fad91067-08c5-4d1a-8d8c-d96a21b37814
type: similar
- id: 61d0475c-173f-4844-86f7-f3eebae1c66b
type: derived
status: test
description: This rule flags PowerShell script content that contains the Set-ExecutionPolicy cmdlet along with insecure execution policy options such as Unrestricted or bypass. Changing execution policy can reduce script execution protections and may enable persistent or stealthy execution of malicious scripts. It relies on PowerShell script block logging telemetry that captures the ScriptBlockText value for the cmdlet and its specified options.
references:
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
- https://adsecurity.org/?p=2604
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml
author: frack113, Huntrule Team
date: 2021-10-20
modified: 2023-12-14
tags:
- attack.execution
- attack.t1059.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_cmdlet:
ScriptBlockText|contains: Set-ExecutionPolicy
selection_option:
ScriptBlockText|contains:
- Unrestricted
- bypass
filter_optional_chocolatey:
ScriptBlockText|contains:
- (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')
- (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')
condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
- Administrator script
level: medium
license: DRL-1.1