PowerShell Execution Policy Set to Unrestricted or Bypass in Registry

The analytic detects changes to the PowerShell ExecutionPolicy in the registry to "Unrestricted" or "Bypass." This activity is significant because setting the ExecutionPolicy to these values can allow the execution of potentially malicious scripts without restriction. If confirmed malicious, this could enable an attacker to execute arbitrary code, leading to further compromise of the system and potential escalation of privileges.