Suspicious Change PowerShell Policies to an Insecure Level - PowerShell (via ps_script)

title: Suspicious Change PowerShell Policies to an Insecure Level - PowerShell (via ps_script)
id: 2fd37e11-9b71-5698-8524-27e0d64acee5
status: stable
description: This rule detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.
references:
    - https://attack.mitre.org/techniques/T1059/001/
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
    - https://adsecurity.org/?p=2604
author: Huntrule Team
date: 2026-04-12
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_cmdlet:
        ScriptBlockText|contains: 'Set-ExecutionPolicy'
    selection_option:
        ScriptBlockText|contains:
            - 'Unrestricted'
            - 'bypass'
    filter_optional_chocolatey:
        ScriptBlockText|contains:
            - "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')"
            - "(New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')"
    condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium