Windows File Creation: __PSScriptPolicyTest_ PowerShell Test Script Written by Uncommon Process

title: "Windows File Creation: __PSScriptPolicyTest_ PowerShell Test Script Written by Uncommon Process"
id: 441249fa-4fa0-4443-92a0-ebf8e1b070d9
status: test
description: This rule flags file creation events where the target filename contains "__PSScriptPolicyTest_", indicating creation of a PowerShell Applocker policy test script. Because this is typically generated by specific PowerShell binaries, an uncommon generating process may indicate evasive scripting or abnormal tooling. It relies on Windows file event telemetry, matching the target filename pattern and excluding several known PowerShell and related help/utility executables.
references:
  - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-01
modified: 2026-10-19
tags:
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: __PSScriptPolicyTest_
  filter_main_powershell:
    Image:
      - C:\Program Files\PowerShell\7-preview\pwsh.exe
      - C:\Program Files\PowerShell\7\pwsh.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  filter_main_pwsh_preview:
    Image|contains:
      - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview
      - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview
    Image|endswith: \pwsh.exe
  filter_main_generic:
    Image:
      - C:\Windows\System32\dsac.exe
      - C:\Windows\System32\sdiagnhost.exe
      - C:\Windows\System32\ServerManager.exe
      - C:\Windows\System32\wsmprovhost.exe
      - C:\Windows\SysWOW64\sdiagnhost.exe
  filter_optional_gethelp:
    Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_
    Image|endswith: \GetHelp.exe
  filter_optional_citrix:
    Image|startswith:
      - C:\Program Files\Citrix\ConfigSync\
      - C:\Program Files (x86)\Citrix\ConfigSync\
    Image|endswith: \ConfigSyncRun.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1027d292-dd87-4a1a-8701-2abe04d7783c
    type: derived