huntrule

Windows Process Creation: PowerShell Execution Policy Registry Tampering via CommandLine

Alerts when a process command line references PowerShell ExecutionPolicy registry paths and weaker policy values.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: PowerShell Execution Policy Registry Tampering via CommandLine"
id: d17fe1bb-8125-44f7-b6b9-2bc8a0374102
related:
  - id: fad91067-08c5-4d1a-8d8c-d96a21b37814
    type: similar
  - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
    type: similar
  - id: 61d0475c-173f-4844-86f7-f3eebae1c66b
    type: similar
  - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f
    type: derived
status: test
description: This rule flags PowerShell execution policy changes suggested by the process command line, where the command references the PowerShell ExecutionPolicy registry paths and includes policy values associated with bypass or reduced signing enforcement. Attackers may tamper with execution policy to run unsigned or less-trusted PowerShell scripts while avoiding security controls. Telemetry relies on Windows process creation events that capture the full command line content.
references:
  - https://learn.microsoft.com/de-de/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_set_unsecure_powershell_policy.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
tags:
  - attack.defense-impairment
logsource:
  product: windows
  category: process_creation
detection:
  selection_path:
    CommandLine|contains:
      - \ShellIds\Microsoft.PowerShell\ExecutionPolicy
      - \Policies\Microsoft\Windows\PowerShell\ExecutionPolicy
  selection_values:
    CommandLine|contains:
      - Bypass
      - RemoteSigned
      - Unrestricted
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags PowerShell execution policy changes suggested by the process command line, where the command references the PowerShell ExecutionPolicy registry paths and includes policy values associated with bypass or reduced signing enforcement. Attackers may tamper with execution policy to run unsigned or less-trusted PowerShell scripts while avoiding security controls. Telemetry relies on Windows process creation events that capture the full command line content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.