Windows File Events: PSScriptPolicyTest Script Creation by Uncommon Process
Alert on __PSScriptPolicyTest_ PowerShell script file creation when the writing process is not an expected PowerShell component.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-01
- Updated
- 2026-07-31
What it detects
This rule flags creation of a PowerShell script file whose name contains "__PSScriptPolicyTest_" when it is written by a process other than common PowerShell executables or related PowerShell preview/help components. Attackers may generate similarly named scripts to blend in with expected PowerShell/AppLocker testing artifacts or to stage policy-related execution paths. The detection relies on Windows file creation telemetry (file_event) that captures the target filename and the creating process image path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Events: PSScriptPolicyTest Script Creation by Uncommon Process"
id: 441249fa-4fa0-4443-92a0-ebf8e1b070d9
status: test
description: This rule flags creation of a PowerShell script file whose name contains "__PSScriptPolicyTest_" when it is written by a process other than common PowerShell executables or related PowerShell preview/help components. Attackers may generate similarly named scripts to blend in with expected PowerShell/AppLocker testing artifacts or to stage policy-related execution paths. The detection relies on Windows file creation telemetry (file_event) that captures the target filename and the creating process image path.
references:
- https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-01
modified: 2026-07-28
tags:
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: __PSScriptPolicyTest_
filter_main_powershell:
Image:
- C:\Program Files\PowerShell\7-preview\pwsh.exe
- C:\Program Files\PowerShell\7\pwsh.exe
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
filter_main_pwsh_preview:
Image|contains:
- C:\Program Files\WindowsApps\Microsoft.PowerShellPreview
- \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview
Image|endswith: \pwsh.exe
filter_main_generic:
Image:
- C:\Windows\System32\dsac.exe
- C:\Windows\System32\sdiagnhost.exe
- C:\Windows\System32\ServerManager.exe
- C:\Windows\System32\wsmprovhost.exe
- C:\Windows\SysWOW64\sdiagnhost.exe
filter_optional_gethelp:
Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_
Image|endswith: \GetHelp.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 1027d292-dd87-4a1a-8701-2abe04d7783c
type: derived