Execution Policy Bypass

This detector looks for code that tries to change the powershell execution policy to Bypass.

Attackers need to change the powershell execution policy in order to run their malicious powershell scripts.

This is a common feature that could be broadly found among malicious code. However, we can enumerate some popular variants using this technique: