PowerShell Enable-WindowsOptionalFeature Enables Suspicious Windows Optional Features (Windows)
Alerts on PowerShell enabling Windows optional features online for specific, potentially risky feature names.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-09-10
- Updated
- 2026-07-31
What it detects
This rule flags PowerShell script blocks invoking the built-in cmdlet Enable-WindowsOptionalFeature with -Online and -FeatureName, specifically when targeting features listed as potentially suspicious. Attackers may enable unnecessary or legacy/remote-access capable Windows components to establish persistence, expand attack surface, or facilitate follow-on activity. The detection relies on Script Block Logging telemetry capturing the ScriptBlockText contents for the cmdlet and its feature name parameters.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/wsl/install-on-server
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Enable-WindowsOptionalFeature Enables Suspicious Windows Optional Features (Windows)
id: 05423491-7b58-4414-9fe1-36acfe8314f6
related:
- id: c740d4cf-a1e9-41de-bb16-8a46a4f57918
type: similar
- id: 55c925c1-7195-426b-a136-a9396800e29b
type: derived
status: test
description: This rule flags PowerShell script blocks invoking the built-in cmdlet Enable-WindowsOptionalFeature with -Online and -FeatureName, specifically when targeting features listed as potentially suspicious. Attackers may enable unnecessary or legacy/remote-access capable Windows components to establish persistence, expand attack surface, or facilitate follow-on activity. The detection relies on Script Block Logging telemetry capturing the ScriptBlockText contents for the cmdlet and its feature name parameters.
references:
- https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
- https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
- https://learn.microsoft.com/en-us/windows/wsl/install-on-server
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml
author: frack113, Huntrule Team
date: 2022-09-10
modified: 2022-12-29
tags:
- attack.stealth
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_cmd:
ScriptBlockText|contains|all:
- Enable-WindowsOptionalFeature
- -Online
- -FeatureName
selection_feature:
ScriptBlockText|contains:
- TelnetServer
- Internet-Explorer-Optional-amd64
- TFTP
- SMB1Protocol
- Client-ProjFS
- Microsoft-Windows-Subsystem-Linux
condition: all of selection_*
falsepositives:
- Legitimate usage of the features listed in the rule.
level: medium
license: DRL-1.1