Windows Process Creation: PowerShell Execution Policy Registry Tampering via CommandLine
Alerts when a process command line references PowerShell ExecutionPolicy registry paths and weaker policy values.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-11
- Updated
- 2026-07-30
What it detects
This rule flags PowerShell execution policy changes suggested by the process command line, where the command references the PowerShell ExecutionPolicy registry paths and includes policy values associated with bypass or reduced signing enforcement. Attackers may tamper with execution policy to run unsigned or less-trusted PowerShell scripts while avoiding security controls. Telemetry relies on Windows process creation events that capture the full command line content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-powershell-execution-policy-registry-tampering-via-comm-cf2e938e
title: "Windows Process Creation: PowerShell Execution Policy Registry Tampering via CommandLine"
id: d17fe1bb-8125-44f7-b6b9-2bc8a0374102
related:
- id: fad91067-08c5-4d1a-8d8c-d96a21b37814
type: similar
- id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
type: similar
- id: 61d0475c-173f-4844-86f7-f3eebae1c66b
type: similar
- id: cf2e938e-9a3e-4fe8-a347-411642b28a9f
type: derived
status: test
description: This rule flags PowerShell execution policy changes suggested by the process command line, where the command references the PowerShell ExecutionPolicy registry paths and includes policy values associated with bypass or reduced signing enforcement. Attackers may tamper with execution policy to run unsigned or less-trusted PowerShell scripts while avoiding security controls. Telemetry relies on Windows process creation events that capture the full command line content.
references:
- https://learn.microsoft.com/de-de/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_set_unsecure_powershell_policy.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
tags:
- attack.defense-impairment
logsource:
product: windows
category: process_creation
detection:
selection_path:
CommandLine|contains:
- \ShellIds\Microsoft.PowerShell\ExecutionPolicy
- \Policies\Microsoft\Windows\PowerShell\ExecutionPolicy
selection_values:
CommandLine|contains:
- Bypass
- RemoteSigned
- Unrestricted
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1