Glossary
Execution policy bypass
Flags such as -ExecutionPolicy Bypass that turn off PowerShell's script-running safety check — a near-ubiquitous marker in malicious launchers.
PowerShell's execution policy is a safety setting that controls whether scripts may run and whether they must be signed. Its values include Restricted, AllSigned, RemoteSigned, Unrestricted and Bypass. Microsoft is explicit that it is not a security boundary: it exists to stop users from running scripts by accident, and any user can override it for their own session. An execution policy bypass is simply a command that does so.
Why it matters in investigations
Malicious launchers routinely disable the policy for one process with -ExecutionPolicy Bypass (or -ep bypass, -ExecutionPolicy Unrestricted) so that a dropped .ps1 runs without a prompt. It usually travels with other launcher switches: -NoProfile to skip profile scripts, -WindowStyle Hidden so the user sees no console, and -EncodedCommand to hide the payload. A persistent change through Set-ExecutionPolicy Bypass or Unrestricted is also worth noting, because it affects every later script.
On its own, a bypass is weak evidence: installers, management agents and admin scripts use it all the time. Its value is in combination. A bypass plus a hidden window plus an encoded command or a download cradle, launched from an Office process or a scheduled task, is a strong signal.
Example
A launcher as recorded in the HostApplication field of a classic-log event:
powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\Users\Public\update.ps1
The parser raises a medium-severity execution policy bypass finding for the -ExecutionPolicy Bypass switch and a separate hidden-window finding for -WindowStyle Hidden, including abbreviated forms such as -ep bypass and -w hidden. Read the two together with the path of the script, then look for that script's content in 4104 events.
Related terms
- Encoded command, the switch most often paired with a bypass
- Download cradle, a common payload of such launchers
- Windows PowerShell classic log, where full command lines are recorded
- Event ID 4104, which records the script that then ran
Triage launch switches across your evidence with the PowerShell Parser, and read the PowerShell event-log guide for where command lines are recorded.