detection.wiki

Detection rules › Sigma

PowerShell Script Execution Policy Enabled

Status
test
Severity
low
Log source
category registry_set, product windows
Author
Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Source
github.com/SigmaHQ/sigma

Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

Known false positives

  • Likely

MITRE ATT&CK coverage

TacticTechniques
ExecutionNo specific technique

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 13: RegistryEvent (Value Set)

Rule body

title: PowerShell Script Execution Policy Enabled
id: 8218c875-90b9-42e2-b60d-0b0069816d10
related:
    - id: fad91067-08c5-4d1a-8d8c-d96a21b37814
      type: derived
status: test
description: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
references:
    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
date: 2023-10-18
tags:
    - attack.execution
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Policies\Microsoft\Windows\PowerShell\EnableScripts'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Likely
level: low

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetObject|endswith: '\Policies\Microsoft\Windows\PowerShell\EnableScripts'
    Details: 'DWORD (0x00000001)'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Detailseq
  • DWORD (0x00000001) corpus 40 (sigma 36, chronicle 4)
field:"Details" kind:eq value:"DWORD (0x00000001)"
TargetObjectends_with
  • \Policies\Microsoft\Windows\PowerShell\EnableScripts
field:"TargetObject" kind:ends_with value:"\Policies\Microsoft\Windows\PowerShell\EnableScripts"