PSScriptPolicyTest Creation By Uncommon Process

{
  "file_event": {
    "EventID": 11,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "TargetFilename
| contains": "__PSScriptPolicyTest_"
  },
  "filter_main_powershell": {
    "Image": [
      "C:\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
    ]
  },
  "filter_main_pwsh_preview": {
    "Image
| contains": [
      "C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview",
      "\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview"
    ],
    "Image
| endswith": "\\pwsh.exe"
  },
  "filter_main_generic": {
    "Image": [
      "C:\\Windows\\System32\\dsac.exe",
      "C:\\Windows\\System32\\sdiagnhost.exe",
      "C:\\Windows\\System32\\ServerManager.exe",
      "C:\\Windows\\System32\\wsmprovhost.exe",
      "C:\\Windows\\SysWOW64\\sdiagnhost.exe"
    ]
  },
  "filter_optional_gethelp": {
    "Image
| startswith": "C:\\Program Files\\WindowsApps\\Microsoft.GetHelp_",
    "Image
| endswith": "\\GetHelp.exe"
  },
  "condition": "file_event and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Unknown