PowerShell Process-Scope Execution Policy Bypass (Veil#Drop)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•2

Detects the use of PowerShell command-line arguments designed to bypass or weaken execution policy restrictions. This includes setting the policy to 'Unrestricted' or 'Bypass' within a specific process scope, which is a common technique used by attackers to execute unsigned or malicious scripts.