PowerShell on Windows adding Windows capabilities via Add-WindowsCapability

title: PowerShell on Windows adding Windows capabilities via Add-WindowsCapability
id: 620b1ae2-46d0-476a-b5ce-018cc81ef664
related:
  - id: 155c7fd5-47b4-49b2-bbeb-eb4fab335429
    type: similar
  - id: b36d01a3-ddaf-4804-be18-18a6247adfcd
    type: derived
status: test
description: This rule flags process executions where PowerShell (powershell.exe or pwsh.exe) runs a command line containing the Add-WindowsCapability cmdlet and specifies a capability string that includes OpenSSH. Attackers may use this to install or enable additional Windows capabilities as part of setup or post-compromise activity. It relies on Windows process creation telemetry, matching on the process image and command-line contents.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell
  - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-22
modified: 2023-05-09
tags:
  - attack.execution
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cmdlet:
    CommandLine|contains: Add-WindowsCapability
  selection_capa:
    CommandLine|contains: OpenSSH.
  condition: all of selection_*
falsepositives:
  - Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly.
level: medium
license: DRL-1.1