Suspicious Change PowerShell Policies to an Insecure Level (via process_creation)

title: Suspicious Change PowerShell Policies to an Insecure Level (via process_creation)
id: fda8f7b7-bbb0-5b2d-b47f-059760a336f2
status: stable
description: This rule detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.
references:
    - https://attack.mitre.org/techniques/T1059/001/
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
    - https://adsecurity.org/?p=2604
    - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/
author: Huntrule Team
date: 2026-03-01
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - OriginalFileName:
              - 'powershell_ise.exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
        - Image|endswith:
              - '\powershell_ise.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
    selection_option:
        CommandLine|contains:
            - '-executionpolicy '
            - ' -ep '
            - ' -exec '
    selection_level:
        CommandLine|contains:
            - 'Bypass'
            - 'Unrestricted'
    filter_main_powershell_core:
        ParentImage:
            - 'C:\Windows\SysWOW64\msiexec.exe'
            - 'C:\Windows\System32\msiexec.exe'
        CommandLine|contains:
            - '-NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\PowerShell\7\'
            - '-NoProfile -ExecutionPolicy Bypass -File "C:\Program Files (x86)\PowerShell\7\'
    filter_optional_avast:
        ParentImage|contains:
            - 'C:\Program Files\Avast Software\Avast\'
            - 'C:\Program Files (x86)\Avast Software\Avast\'
            - '\instup.exe'
        CommandLine|contains:
            - '-ExecutionPolicy ByPass -File "C:\Program Files\Avast Software\Avast'
            - '-ExecutionPolicy ByPass -File "C:\Program Files (x86)\Avast Software\Avast\'
    filter_hr:
        ParentImage|endswith: \chocolatey\choco.exe
        CommandLine|contains: -ExecutionPolicy Bypass
    condition: (all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*) and not filter_hr
falsepositives:
    - Unknown
level: medium