Suspicious Add Windows Capability Through PowerShell Cmdlet (via process_creation)

title: Suspicious Add Windows Capability Through PowerShell Cmdlet (via process_creation)
id: 3b4a2085-c5cb-5b10-bb17-9d3e02be2806
status: stable
description: This rule detects use of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell
    - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content
author: Huntrule Team
date: 2026-03-15
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cmdlet:
        CommandLine|contains: 'Add-WindowsCapability'
    selection_capa:
        CommandLine|contains: 'OpenSSH.'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium