Windows Registry PowerShell ExecutionPolicy Tampering (Bypass/Unrestricted)
Alerts on Windows registry changes that set PowerShell ExecutionPolicy to Bypass or Unrestricted.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-11
- Updated
- 2026-07-30
What it detects
This rule flags registry updates that modify PowerShell ExecutionPolicy settings to values containing "Bypass" or "Unrestricted". Attackers may use these changes to weaken or avoid script signing controls, enabling easier execution of malicious PowerShell scripts. The detection relies on registry_set telemetry for changes to ExecutionPolicy-related TargetObject paths and matches on the updated Details content while excluding updates attributed to svchost paths.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-powershell-executionpolicy-tampering-bypass-unrestricted-fad91067
title: Windows Registry PowerShell ExecutionPolicy Tampering (Bypass/Unrestricted)
id: 123dec7f-74ce-46b5-9580-dd73d84cccbe
related:
- id: cf2e938e-9a3e-4fe8-a347-411642b28a9f
type: similar
- id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
type: similar
- id: 61d0475c-173f-4844-86f7-f3eebae1c66b
type: similar
- id: fad91067-08c5-4d1a-8d8c-d96a21b37814
type: derived
status: test
description: This rule flags registry updates that modify PowerShell ExecutionPolicy settings to values containing "Bypass" or "Unrestricted". Attackers may use these changes to weaken or avoid script signing controls, enabling easier execution of malicious PowerShell scripts. The detection relies on registry_set telemetry for changes to ExecutionPolicy-related TargetObject paths and matches on the updated Details content while excluding updates attributed to svchost paths.
references:
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_powershell_execution_policy.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-11
modified: 2023-12-14
tags:
- attack.defense-impairment
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith:
- \ShellIds\Microsoft.PowerShell\ExecutionPolicy
- \Policies\Microsoft\Windows\PowerShell\ExecutionPolicy
Details|contains:
- Bypass
- Unrestricted
filter_main_svchost:
Image|contains:
- :\Windows\System32\
- :\Windows\SysWOW64\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1