Windows File Creation: __PSScriptPolicyTest_ PowerShell Test Script Written by Uncommon Process
Alert on __PSScriptPolicyTest_ PowerShell script file creation when the writing process is not an expected PowerShell component.
FreeReviewedSigma · Medium · v4
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-01
- Updated
- 2026-10-21
What it detects
This rule flags file creation events where the target filename contains "__PSScriptPolicyTest_", indicating creation of a PowerShell Applocker policy test script. Because this is typically generated by specific PowerShell binaries, an uncommon generating process may indicate evasive scripting or abnormal tooling. It relies on Windows file event telemetry, matching the target filename pattern and excluding several known PowerShell and related help/utility executables.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-10-21
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-creation-psscriptpolicytest-random-generated-by-uncommon-process-1027d292
title: "Windows File Creation: __PSScriptPolicyTest_ PowerShell Test Script Written by Uncommon Process"
id: 441249fa-4fa0-4443-92a0-ebf8e1b070d9
status: test
description: This rule flags file creation events where the target filename contains "__PSScriptPolicyTest_", indicating creation of a PowerShell Applocker policy test script. Because this is typically generated by specific PowerShell binaries, an uncommon generating process may indicate evasive scripting or abnormal tooling. It relies on Windows file event telemetry, matching the target filename pattern and excluding several known PowerShell and related help/utility executables.
references:
- https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-01
modified: 2026-10-19
tags:
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: __PSScriptPolicyTest_
filter_main_powershell:
Image:
- C:\Program Files\PowerShell\7-preview\pwsh.exe
- C:\Program Files\PowerShell\7\pwsh.exe
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
filter_main_pwsh_preview:
Image|contains:
- C:\Program Files\WindowsApps\Microsoft.PowerShellPreview
- \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview
Image|endswith: \pwsh.exe
filter_main_generic:
Image:
- C:\Windows\System32\dsac.exe
- C:\Windows\System32\sdiagnhost.exe
- C:\Windows\System32\ServerManager.exe
- C:\Windows\System32\wsmprovhost.exe
- C:\Windows\SysWOW64\sdiagnhost.exe
filter_optional_gethelp:
Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_
Image|endswith: \GetHelp.exe
filter_optional_citrix:
Image|startswith:
- C:\Program Files\Citrix\ConfigSync\
- C:\Program Files (x86)\Citrix\ConfigSync\
Image|endswith: \ConfigSyncRun.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 1027d292-dd87-4a1a-8701-2abe04d7783c
type: derived