Change PowerShell Execution Policy to Insecure Level

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects attempts to change the PowerShell script execution policy to a less secure level (Unrestricted or Bypass) using the `Set-ExecutionPolicy` cmdlet. This action can allow unsigned or untrusted scripts to run, increasing the risk of malicious code execution.