cscli scenarios install sigmahq/proc_creation_win_registry_set_unsecure_powershell_policy1type: trigger2name: sigmahq/proc_creation_win_registry_set_unsecure_powershell_policy3description: |4 Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.CommandLine contains '\\ShellIds\\Microsoft.PowerShell\\ExecutionPolicy' || evt.Parsed.CommandLine contains '\\Policies\\Microsoft\\Windows\\PowerShell\\ExecutionPolicy') && (evt.Parsed.CommandLine contains 'Bypass' || evt.Parsed.CommandLine contains 'RemoteSigned' || evt.Parsed.CommandLine contains 'Unrestricted'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:1415 label: "Potential PowerShell Execution Policy Tampering - ProcCreation"16 behavior : "windows:audit"17 remediation: false1819scope:20 type: ParentProcessId21 expression: evt.Parsed.ParentProcessId2223