Hayabusa low test sigma

PowerShell Script Execution Policy Enabled

Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

View Source

Detection Logic

{
  "registry_set": {
    "EventID": 4657,
    "Channel": "Security"
  },
  "selection": {
    "ObjectName
| endswith": "\\Policies\\Microsoft\\Windows\\PowerShell\\EnableScripts",
    "NewValue": "DWORD (0x00000001)"
  },
  "condition": "registry_set and selection"
}

False Positives

  • ⚠ Likely

Field Validations

Loading…

Comments (0)

Loading comments...