Query: detect Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execu in logs
Matching passage: Sigma rule: Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execu. Logsource: windows / process_creation. Rule: title: Potential PowerShell Execution Policy Tampering - ProcCreation id: cf2e938e-9a3e-4fe8-a347-411642b28a9f related: - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: similar - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 type: similar - id: 61d0475c-173f-4844-86f7-f3eebae1c66b type: similar status: test description: Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine references: - https://learn.microsoft.com/de-de/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 tags: - attack.defense-impairment logsource: product: windows category: process_creation detection: selection_path: CommandLine|contains: - \ShellIds\Microsoft.PowerShell\ExecutionPolicy - \Policies\Microsoft\Windows\PowerShell\ExecutionPolicy selection_values: CommandLine|contains: - Bypass - RemoteSigned - Unrestricted condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the attempt to install new skills for AI agents using the "npx skills" command. Agent skills enhance AI agents w. Logsource: windows / process_creation. Rule: title: New Agent Skills Installation Attempt Via Node.EXE id: afa71271-6a97-4e47-810f-83120fb1a4ce status: experimental description: 'Detects the attempt to install new skills for AI agents using the "npx skills" command. Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user. The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others). Analysts should review any installed skills to verify their legitimacy. Note: Tune this rule based on whether AI agent tooling is allowed in your environment. In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly. In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation. ' references: - https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms/ - https://github.com/vercel-labs/skills/blob/1f7fbc8d0e49c4e0601d364696bd1bdd15e80967/README.md - https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto - https://promptintel.novahunting.ai/molt author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-02-03 tags: - attack.execution - attack.t1059.007 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \node.exe - OriginalFileName: node.exe selection_cli: CommandLine|contains|all: - npx-cli.js - 'skills ' - ' add ' condition: all of selection_* falsepositives: - This rule will be triggered when a new agent skill is installed regardless if it is benign or malicious. - High false positive rate expected in environments where AI agent tooling is authorized and commonly used. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed/info.yml