Windows PowerShell EnableScripts Policy Enabled via Registry DWORD
Flags registry changes that enable PowerShell script execution via the EnableScripts policy (DWORD 0x00000001).
FreeReviewedSigma · Low · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems), Thurein Oo (SigmaHQ), DRL 1.1
- Published
- 2023-10-18
- Updated
- 2026-07-30
What it detects
This rule identifies when the Windows PowerShell script execution policy is enabled by setting a specific registry value under the EnableScripts policy path. Enabling this setting permits PowerShell scripts to run, which can reduce barriers to attacker execution and persistence. The detection relies on registry set telemetry capturing the TargetObject ending in the EnableScripts policy key and the Details value of DWORD 0x00000001.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-enablescripts-policy-enabled-via-registry-dword-8218c875
title: Windows PowerShell EnableScripts Policy Enabled via Registry DWORD
id: e7446f7b-ccac-477e-b82d-b817f804f3b6
related:
- id: fad91067-08c5-4d1a-8d8c-d96a21b37814
type: derived
- id: 8218c875-90b9-42e2-b60d-0b0069816d10
type: derived
status: test
description: This rule identifies when the Windows PowerShell script execution policy is enabled by setting a specific registry value under the EnableScripts policy path. Enabling this setting permits PowerShell scripts to run, which can reduce barriers to attacker execution and persistence. The detection relies on registry set telemetry capturing the TargetObject ending in the EnableScripts policy key and the Details value of DWORD 0x00000001.
references:
- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_powershell_enablescripts_enabled.yml
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule Team
date: 2023-10-18
tags:
- attack.execution
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: \Policies\Microsoft\Windows\PowerShell\EnableScripts
Details: DWORD (0x00000001)
condition: selection
falsepositives:
- Likely
level: low
license: DRL-1.1