PowerShell Run Key Persistence with ExecutionPolicy Bypass and Hidden Window

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the creation or modification of a Registry Run key to establish persistence using PowerShell with specific obfuscation techniques. The rule looks for PowerShell commands that include '-NoProfile', '-ExecutionPolicy Bypass', '-WindowStyle Hidden', and '-File', and also references a temporary directory ('AppData\\Local\\Temp'). This combination is often used by adversaries to execute malicious scripts discreetly upon user logon.