PowerShell Run Key Persistence with ExecutionPolicy Bypass and Hidden Window

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the creation or modification of a Registry Run key that executes PowerShell with specific parameters indicating a hidden window, no profile, bypass execution policy, and referencing a script in the AppData\Local\Temp directory. This is a common technique used by adversaries for persistence and to evade detection.