Suspicious Add Windows Capability Through PowerShell Script (via ps_script)

title: Suspicious Add Windows Capability Through PowerShell Script (via ps_script)
id: 0ef08a83-ae6e-53dd-8c6d-93fe1f3f6f10
status: stable
description: This rule detects use of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell
    - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content
author: Huntrule Team
date: 2026-02-08
tags:
    - attack.execution
    - attack.lateral-movement
    - attack.persistence
    - attack.t1021.004
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_cmdlet:
        ScriptBlockText|contains: 'Add-WindowsCapability '
    selection_capa:
        ScriptBlockText|contains: '-Name OpenSSH.'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium