PowerShell Disable-WindowsOptionalFeature -Online -FeatureName Targeting Windows Defender Features

title: PowerShell Disable-WindowsOptionalFeature -Online -FeatureName Targeting Windows Defender Features
id: 59d041aa-d38d-4572-97a3-4b6143c991bd
status: test
description: This rule flags PowerShell script block activity invoking the built-in Disable-WindowsOptionalFeature cmdlet with -Online and -FeatureName. It specifically matches feature names related to Windows Defender, including Windows-Defender-Gui and Windows-Defender-ApplicationGuard. Disabling security-related Windows features can reduce endpoint protections, and the detection relies on ScriptBlockText content from PowerShell script block logging.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/5b67c9b141fa3918017f8fa44f2f88f0b1ecb9e1/atomics/T1562.001/T1562.001.md
  - https://learn.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml
author: frack113, Huntrule Team
date: 2022-09-10
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmd:
    ScriptBlockText|contains|all:
      - Disable-WindowsOptionalFeature
      - -Online
      - -FeatureName
  selection_feature:
    ScriptBlockText|contains:
      - Windows-Defender-Gui
      - Windows-Defender-Features
      - Windows-Defender
      - Windows-Defender-ApplicationGuard
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 99c4658d-2c5e-4d87-828d-7c066ca537c3
    type: derived