PowerShell Disable-WindowsOptionalFeature -Online -FeatureName for Windows Defender features
Detects PowerShell disabling online Windows Defender features via Disable-WindowsOptionalFeature -FeatureName.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-09-10
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block activity invoking Disable-WindowsOptionalFeature with -Online and -FeatureName. It additionally requires the script text to reference Windows Defender-related feature names, which may indicate an attempt to impair host defenses. The detection relies on ScriptBlockText content from PowerShell script block logging.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/5b67c9b141fa3918017f8fa44f2f88f0b1ecb9e1/atomics/T1562.001/T1562.001.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Disable-WindowsOptionalFeature -Online -FeatureName for Windows Defender features
id: 59d041aa-d38d-4572-97a3-4b6143c991bd
status: test
description: This rule flags PowerShell script block activity invoking Disable-WindowsOptionalFeature with -Online and -FeatureName. It additionally requires the script text to reference Windows Defender-related feature names, which may indicate an attempt to impair host defenses. The detection relies on ScriptBlockText content from PowerShell script block logging.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/5b67c9b141fa3918017f8fa44f2f88f0b1ecb9e1/atomics/T1562.001/T1562.001.md
- https://learn.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml
author: frack113, Huntrule Team
date: 2022-09-10
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_cmd:
ScriptBlockText|contains|all:
- Disable-WindowsOptionalFeature
- -Online
- -FeatureName
selection_feature:
ScriptBlockText|contains:
- Windows-Defender-Gui
- Windows-Defender-Features
- Windows-Defender
- Windows-Defender-ApplicationGuard
condition: all of selection*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 99c4658d-2c5e-4d87-828d-7c066ca537c3
type: derived