huntrule

Windows PowerShell EnableScripts Policy Enabled via Registry DWORD

Flags registry changes that enable PowerShell script execution via the EnableScripts policy (DWORD 0x00000001).

FreeUnreviewedSigmalowv1
title: Windows PowerShell EnableScripts Policy Enabled via Registry DWORD
id: e7446f7b-ccac-477e-b82d-b817f804f3b6
related:
  - id: fad91067-08c5-4d1a-8d8c-d96a21b37814
    type: derived
  - id: 8218c875-90b9-42e2-b60d-0b0069816d10
    type: derived
status: test
description: This rule identifies when the Windows PowerShell script execution policy is enabled by setting a specific registry value under the EnableScripts policy path. Enabling this setting permits PowerShell scripts to run, which can reduce barriers to attacker execution and persistence. The detection relies on registry set telemetry capturing the TargetObject ending in the EnableScripts policy key and the Details value of DWORD 0x00000001.
references:
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_powershell_enablescripts_enabled.yml
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule Team
date: 2023-10-18
tags:
  - attack.execution
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Policies\Microsoft\Windows\PowerShell\EnableScripts
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Likely
level: low
license: DRL-1.1

What it detects

This rule identifies when the Windows PowerShell script execution policy is enabled by setting a specific registry value under the EnableScripts policy path. Enabling this setting permits PowerShell scripts to run, which can reduce barriers to attacker execution and persistence. The detection relies on registry set telemetry capturing the TargetObject ending in the EnableScripts policy key and the Details value of DWORD 0x00000001.

Known false positives

  • Likely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.