PSScriptPolicyTest Creation By Uncommon Process

This brief highlights a detection method for identifying suspicious activity related to PowerShell policy testing. The __PSScriptPolicyTest_ file is a temporary file typically created by legitimate PowerShell executables to evaluate AppLocker or other execution policies. When this file is created by an "uncommon process," i.e., any process not officially sanctioned to perform PowerShell policy tests, it can indicate attempts by adversaries to stealthily test or bypass security controls. This technique, often associated with evasion (as noted by Palo Alto Networks regarding "stopping PowerShell without PowerShell"), suggests a potential for reconnaissance of security mechanisms or preparation for executing malicious code outside of standard PowerShell monitoring. There is no specific threat actor or campaign associated with this detection; rather, it identifies a behavioral anomaly that could be leveraged by various advanced persistent threat groups or red team operations.

Attack Chain

The provided source describes a detection for a specific suspicious behavior rather than a multi-step attack chain. This behavior typically occurs as part of a larger campaign focused on defense evasion.

Impact

Successful use of this technique would indicate an adversary's attempt to understand or bypass an organization's PowerShell execution policies, potentially allowing for the execution of unauthorized scripts or applications without detection. While not an immediate compromise, it is a strong indicator of advanced reconnaissance or defense evasion activity, which could precede more impactful stages like persistent access, data exfiltration, or further lateral movement. This activity suggests an adversary is actively probing security controls to ensure their malicious activities remain undetected.

Recommendation

• Deploy the Sigma rule "PSScriptPolicyTest Creation By Uncommon Process" to your SIEM and tune for your environment.
• Ensure file event logging for the file_event category and windows product is enabled and comprehensive, especially for TargetFilename to capture __PSScriptPolicyTest_ patterns.
• Investigate all alerts generated by the "PSScriptPolicyTest Creation By Uncommon Process" rule to determine the legitimacy of the creating process and its parent process, referencing the Palo Alto Networks article for context.
• Review logs for associated process creation events to understand the full context of the suspicious activity.