PowerShell Execution Policy Modification

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•5

Detects attempts to modify the PowerShell execution policy using 'Set-ExecutionPolicy'. This command can be used by adversaries to lower security restrictions and enable the execution of unsigned or malicious PowerShell scripts.