LOLBIN created a PSScriptPolicyTest PowerShell script file

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter: PowerShell (T1059.001)
Severity	Informational

A LOLBIN created a PSScriptPolicyTest file. This may be a sign of malicious PowerShell execution without directly invoking the powershell.exe binary.

Executing PowerShell scripts in a stealthy manner.

Investigate the process and command line that created the file and whether it's benign or normal for this host.
Investigate the created PowerShell file for potential malicious commands.

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter: PowerShell (T1059.001)
Severity	Medium

A LOLBIN created a PSScriptPolicyTest file. This may be a sign of malicious PowerShell execution without directly invoking the powershell.exe binary.

Executing PowerShell scripts in a stealthy manner.

Investigate the process and command line that created the file and whether it's benign or normal for this host.
Investigate the created PowerShell file for potential malicious commands.