LoFP LoFP / administrator scripts

Techniques

Sample rules

Change PowerShell Policies to an Insecure Level

Description

Detects changing the PowerShell script execution policy to a potentially insecure level using the “-ExecutionPolicy” flag.

Detection logic

condition: all of selection_*
selection_img:
- OriginalFileName:
  - PowerShell.EXE
  - pwsh.dll
- Image|endswith:
  - \powershell.exe
  - \pwsh.exe
selection_level:
  CommandLine|contains:
  - Bypass
  - Unrestricted
selection_option:
  CommandLine|contains:
  - '-executionpolicy '
  - ' -ep '
  - ' -exec '