Windows Registry PowerShell ExecutionPolicy Tampering (Bypass/Unrestricted)

title: Windows Registry PowerShell ExecutionPolicy Tampering (Bypass/Unrestricted)
id: 123dec7f-74ce-46b5-9580-dd73d84cccbe
related:
  - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f
    type: similar
  - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
    type: similar
  - id: 61d0475c-173f-4844-86f7-f3eebae1c66b
    type: similar
  - id: fad91067-08c5-4d1a-8d8c-d96a21b37814
    type: derived
status: test
description: This rule flags registry updates that modify PowerShell ExecutionPolicy settings to values containing "Bypass" or "Unrestricted". Attackers may use these changes to weaken or avoid script signing controls, enabling easier execution of malicious PowerShell scripts. The detection relies on registry_set telemetry for changes to ExecutionPolicy-related TargetObject paths and matches on the updated Details content while excluding updates attributed to svchost paths.
references:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_powershell_execution_policy.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
modified: 2023-12-14
tags:
  - attack.defense-impairment
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith:
      - \ShellIds\Microsoft.PowerShell\ExecutionPolicy
      - \Policies\Microsoft\Windows\PowerShell\ExecutionPolicy
    Details|contains:
      - Bypass
      - Unrestricted
  filter_main_svchost:
    Image|contains:
      - :\Windows\System32\
      - :\Windows\SysWOW64\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1