Query: detect Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" fla in logs
Matching passage: Sigma rule: Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" fla. Logsource: windows / process_creation. Rule: title: Change PowerShell Policies to an Insecure Level id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 61d0475c-173f-4844-86f7-f3eebae1c66b type: similar - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: similar status: test description: Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4 - https://adsecurity.org/?p=2604 - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/ author: frack113 date: 2021-11-01 modified: 2025-10-07 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_img: - OriginalFileName: - powershell_ise.exe - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe selection_option: CommandLine|contains: - '-executionpolicy ' - ' -ep ' - ' -exec ' selection_level: CommandLine|contains: - Bypass - Unrestricted filter_main_powershell_core: ParentImage: - C:\Windows\SysWOW64\msiexec.exe - C:\Windows\System32\msiexec.exe CommandLine|contains: - -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\PowerShell\7\ - -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files (x86)\PowerShell\7\ filter_optional_avast: ParentImage|contains: - C:\Program Files\Avast Software\Avast\ - C:\Program Files (x86)\Avast Software\Avast\ - \instup.exe CommandLine|contains: - -ExecutionPolicy ByPass -File "C:\Program Files\Avast Software\Avast - -ExecutionPolicy ByPass -File "C:\Program Files (x86)\Avast Software\Avast\ condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrator scripts level: medium
Near-miss passage: Sigma rule: Detect execution of suspicious double extension files in ParentCommandLine. Logsource: windows / process_creation. Rule: title: Suspicious Parent Double Extension File Execution id: 5e6a80c8-2d45-4633-9ef4-fa2671a39c5c related: - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8 type: derived status: test description: Detect execution of suspicious double extension files in ParentCommandLine references: - https://www.virustotal.com/gui/file/7872d8845a332dce517adae9c3389fde5313ff2fed38c2577f3b498da786db68/behavior - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-01-06 modified: 2023-02-28 tags: - attack.stealth - attack.t1036.007 logsource: category: process_creation product: windows detection: selection: - ParentImage|endswith: - .doc.lnk - .docx.lnk - .xls.lnk - .xlsx.lnk - .ppt.lnk - .pptx.lnk - .rtf.lnk - .pdf.lnk - .txt.lnk - .doc.js - .docx.js - .xls.js - .xlsx.js - .ppt.js - .pptx.js - .rtf.js - .pdf.js - .txt.js - ParentCommandLine|contains: - .doc.lnk - .docx.lnk - .xls.lnk - .xlsx.lnk - .ppt.lnk - .pptx.lnk - .rtf.lnk - .pdf.lnk - .txt.lnk - .doc.js - .docx.js - .xls.js - .xlsx.js - .ppt.js - .pptx.js - .rtf.js - .pdf.js - .txt.js condition: selection falsepositives: - Unknown level: high