Potential PowerShell Execution Policy Tampering
Detects changes to the PowerShell execution policy in the Windows Registry to bypass signing requirements for script execution. This rule specifically looks for modifications to the 'ExecutionPolicy' registry values under PowerShell-related paths, setting them to 'Bypass' or 'Unrestricted'. It also filters out changes made by 'svchost' to reduce false positives.
Sigma
