PowerShell Execution Policy Modification to Insecure Level

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•13

Detects attempts to change the PowerShell script execution policy to a less secure level (Bypass or Unrestricted) using the '-ExecutionPolicy' flag. This can be abused by adversaries to execute unsigned or malicious scripts.