Sigma low test sigma

PowerShell Script Execution Policy Enabled

Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.

View Source

Detection Logic

{
  "selection": {
    "TargetObject
| endswith": "\\Policies\\Microsoft\\Windows\\PowerShell\\EnableScripts",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

False Positives

⚠ Likely

Field Validations

Loading…

Comments (0)

Loading comments...