PowerShell on Windows adding Windows capabilities via Add-WindowsCapability
Alerts when PowerShell adds an OpenSSH-related Windows capability using Add-WindowsCapability.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-22
- Updated
- 2026-07-30
What it detects
This rule flags process executions where PowerShell (powershell.exe or pwsh.exe) runs a command line containing the Add-WindowsCapability cmdlet and specifies a capability string that includes OpenSSH. Attackers may use this to install or enable additional Windows capabilities as part of setup or post-compromise activity. It relies on Windows process creation telemetry, matching on the process image and command-line contents.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell
- virustotal.comhttps://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
powershell-on-windows-adding-windows-capabilities-via-add-windowscapability-b36d01a3
title: PowerShell on Windows adding Windows capabilities via Add-WindowsCapability
id: 620b1ae2-46d0-476a-b5ce-018cc81ef664
related:
- id: 155c7fd5-47b4-49b2-bbeb-eb4fab335429
type: similar
- id: b36d01a3-ddaf-4804-be18-18a6247adfcd
type: derived
status: test
description: This rule flags process executions where PowerShell (powershell.exe or pwsh.exe) runs a command line containing the Add-WindowsCapability cmdlet and specifies a capability string that includes OpenSSH. Attackers may use this to install or enable additional Windows capabilities as part of setup or post-compromise activity. It relies on Windows process creation telemetry, matching on the process image and command-line contents.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell
- https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-22
modified: 2023-05-09
tags:
- attack.execution
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
selection_cmdlet:
CommandLine|contains: Add-WindowsCapability
selection_capa:
CommandLine|contains: OpenSSH.
condition: all of selection_*
falsepositives:
- Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly.
level: medium
license: DRL-1.1