Bypass or Unrestricted PowerShell Execution (PowerShell)

id: '22489.40177'
title: Bypass or Unrestricted PowerShell Execution
description: 'This use case identifies instances where PowerShell is executed with
  specific, potentially insecure execution policies such as Unrestricted, Bypass,
  or RemoteSigned. Threat actors may exploit these settings to execute malicious scripts
  or commands, as they allow scripts to run without the usual restrictions and without
  requiring digital signatures. -- Threat Actor Association: UNC4990 - Software Association:
  Rhysida'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (" -ExecutionPolicy
  " OR " -ep " OR " -exec ") ("Unrestricted" OR "bypass" OR "RemoteSigned") | where
  not match(process, "(?i):\x5c(Program\sFiles|ProgramData|AppData\x5cRoaming\x5cCode\x5c)")
  | table _time, host, user process, process_*, signature_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
technique_id:
- T1059.001
data_category:
- PowerShell logs
references:
- https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/
- https://adsecurity.org/?p=2604
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.1