Level 15 92213 PSScriptPolicyTest false positive

Description

__PSScriptPolicyTest_<random>.ps1 is a file created by powershell on launch to check whether AppLocker or WDAC is enforcing a script policy and then deleted. Sysmon flags the file creation and Wazuh rule 92213 flags it because malware commonly stage scripts and exes in Temp. The rule is reasonable but level 15 is Wazuh’s highest severity and the alert being triggered on every powershell launch would interfere with the real high severity alerts made by the atomics.

_{Figure 1: Benign alerts showing up as the highest level in Wazuh}

WS01 JSON Excerpt

{
    "agent": {
      "ip": "192.168.56.20",
      "name": "WS01",
      "id": "001"
    },
    "data": {
      "win": {
        "eventdata": {
          "image": "C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe",
          "utcTime": "2026-10-04 10:07:25.779",
          "targetFilename": "C:\\\\Users\\\\alice.user\\\\AppData\\\\Local\\\\Temp\\\\__PSScriptPolicyTest_oeuam2pu.upg.ps1",
          "ruleName": "technique_id=T1059.001,technique_name=PowerShell",
          "creationUtcTime": "2026-10-04 10:07:25.779",
          "user": "LAB\\\\alice.user"
        },
        "system": {
          "eventID": "11",
          "channel": "Microsoft-Windows-Sysmon/Operational"
        }
      }
    },
    "rule": {
      "firedtimes": 2,
      "id": "92213",
      "level": 15,
      "description": "Executable file dropped in folder commonly used by malware",
      "groups": [
        "sysmon",
        "sysmon_eid11_detections",
        "windows"
      ],
      "mitre": {
        "technique": [
          "Ingress Tool Transfer"
        ],
        "id": [
          "T1105"
        ],
        "tactic": [
          "Command and Control"
        ]
      }
    }
}

The rule

Added to /var/ossec/etc/rules/local_rules.xml on the Wazuh manager:

<group name="sysmon,local,">
  <rule id="100100" level="3">
    <if_sid>92213</if_sid>
    <field name="win.eventdata.image" type="pcre2">(?i)\\\\WindowsPowerShell\\\\v1\.0\\\\powershell\.exe$</field>
    <field name="win.eventdata.targetFilename" type="pcre2">(?i)\\\\AppData\\\\Local\\\\Temp\\\\__PSScriptPolicyTest_[a-z0-9]{8}\.[a-z0-9]{3}\.psm?1$</field>
    <description>Benign: PowerShell Applocker/WDAC policy test</description>
  </rule>
</group>

_{Figure 2: New alerts caused by rule}

I also wanted to make sure 92213 still fired on non benign files. To do this I created a file called drop-test.ps1 in Temp (see below).

_{Figure 3: 92213 alert still firing on unusual file}