[WINDOWS-SYSMON] PS1 set in Registry Key

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] PS1 set in Registry Key"; program:*Sysmon*; event_id:13; content:"Details: "; nocase; content:".ps1 "; content:!"
| 5c
| Group Policy
| 5c
| "; reference:url,thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/; classtype:trojan-activity; sid:5013836; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_01, updated_at 2023_02_01, mitre_tactic_id TA0005, mitre_technique_id T1112;)