huntrule

PowerShell Enable-WindowsOptionalFeature Online With Potentially Risky FeatureName

Alerts on PowerShell enabling Windows optional features online for specific, potentially risky feature names.

FreeUnreviewedSigmamediumv1
title: PowerShell Enable-WindowsOptionalFeature Online With Potentially Risky FeatureName
id: 05423491-7b58-4414-9fe1-36acfe8314f6
related:
  - id: c740d4cf-a1e9-41de-bb16-8a46a4f57918
    type: similar
  - id: 55c925c1-7195-426b-a136-a9396800e29b
    type: derived
status: test
description: This rule flags PowerShell activity where the cmdlet Enable-WindowsOptionalFeature is invoked with -Online and -FeatureName, indicating Windows feature or package changes in the live system. It additionally matches specific feature names that are often associated with expanded attack surface, such as legacy or network services. The detection relies on Script Block Logging telemetry containing the referenced cmdlet and parameter text.
references:
  - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
  - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
  - https://learn.microsoft.com/en-us/windows/wsl/install-on-server
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml
author: frack113, Huntrule Team
date: 2022-09-10
modified: 2022-12-29
tags:
  - attack.stealth
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmd:
    ScriptBlockText|contains|all:
      - Enable-WindowsOptionalFeature
      - -Online
      - -FeatureName
  selection_feature:
    ScriptBlockText|contains:
      - TelnetServer
      - Internet-Explorer-Optional-amd64
      - TFTP
      - SMB1Protocol
      - Client-ProjFS
      - Microsoft-Windows-Subsystem-Linux
  condition: all of selection_*
falsepositives:
  - Legitimate usage of the features listed in the rule.
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell activity where the cmdlet Enable-WindowsOptionalFeature is invoked with -Online and -FeatureName, indicating Windows feature or package changes in the live system. It additionally matches specific feature names that are often associated with expanded attack surface, such as legacy or network services. The detection relies on Script Block Logging telemetry containing the referenced cmdlet and parameter text.

Known false positives

  • Legitimate usage of the features listed in the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.