Windows File Creation: PSScriptPolicyTest_<random> Generated by Uncommon Process

title: "Windows File Creation: PSScriptPolicyTest_<random> Generated by Uncommon Process"
id: 441249fa-4fa0-4443-92a0-ebf8e1b070d9
status: test
description: This rule flags file creation events where the target filename contains the __PSScriptPolicyTest_ pattern, indicating a PSScriptPolicyTest PowerShell script file was written. It matters because attackers can use PowerShell-related artifacts and test-like filenames to blend in with legitimate activity or probe execution policy behavior. The detection relies on Windows file event telemetry and evaluates the creating process image against a set of commonly observed PowerShell and related system utilities, alerting when the creator is not in the expected list.
references:
  - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-01
modified: 2026-07-28
tags:
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: __PSScriptPolicyTest_
  filter_main_powershell:
    Image:
      - C:\Program Files\PowerShell\7-preview\pwsh.exe
      - C:\Program Files\PowerShell\7\pwsh.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  filter_main_pwsh_preview:
    Image|contains:
      - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview
      - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview
    Image|endswith: \pwsh.exe
  filter_main_generic:
    Image:
      - C:\Windows\System32\dsac.exe
      - C:\Windows\System32\sdiagnhost.exe
      - C:\Windows\System32\ServerManager.exe
      - C:\Windows\System32\wsmprovhost.exe
      - C:\Windows\SysWOW64\sdiagnhost.exe
  filter_optional_gethelp:
    Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_
    Image|endswith: \GetHelp.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1027d292-dd87-4a1a-8701-2abe04d7783c
    type: derived