PowerShell Script Execution Policy Enabled

Hunt Hypothesis

Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

Detection Rule

Sigma (Original)

title: PowerShell Script Execution Policy Enabled
id: 8218c875-90b9-42e2-b60d-0b0069816d10
related:
    - id: fad91067-08c5-4d1a-8d8c-d96a21b37814
      type: derived
status: test
description: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
references:
    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
date: 2023-10-18
tags:
    - attack.execution
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Policies\Microsoft\Windows\PowerShell\EnableScripts'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Likely
level: low

KQL (Azure Sentinel)

imRegistry
| where RegistryKey endswith "\\Policies\\Microsoft\\Windows\\PowerShell\\EnableScripts" and RegistryValueData =~ "DWORD (0x00000001)"

KQL (Microsoft 365 Defender)

DeviceRegistryEvents
| where RegistryKey endswith "\\Policies\\Microsoft\\Windows\\PowerShell\\EnableScripts" and RegistryValueData =~ "DWORD (0x00000001)"

Required Data Sources

False Positive Guidance

• Likely

MITRE ATT&CK Context

• Tactic: Execution

References

• https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts
• SigmaHQ Rule