UNCanny LPE PoC PowerShell ExecutionPolicy Bypass from Public Directory

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects PowerShell execution with '-ExecutionPolicy Bypass -File' arguments, combined with specific suspicious file paths or command-line strings often associated with privilege escalation or malicious activity. It also looks for suspicious AppX package management commands.