Windows: PowerShell Enable-WindowsOptionalFeature Enables Suspicious Optional Features
Alerts on PowerShell Enable-WindowsOptionalFeature used with -Online to enable listed optional features.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-29
- Updated
- 2026-07-30
What it detects
This rule flags PowerShell process creation where the command line includes Enable-WindowsOptionalFeature with -Online and -FeatureName, and the feature name matches a set of potentially risky Windows optional features. Attackers can use Windows feature enablement to introduce new services or capabilities and expand persistence or access in environments where those components are not normally used. It relies on process creation telemetry, specifically the PowerShell command line contents.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/wsl/install-on-server
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_enable_susp_windows_optional_feature.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-enable-windowsoptionalfeature-enables-suspicious-optional-fea-c740d4cf
title: "Windows: PowerShell Enable-WindowsOptionalFeature Enables Suspicious Optional Features"
id: 18f3be5b-1e28-4211-a180-d9dfcf37862f
related:
- id: 55c925c1-7195-426b-a136-a9396800e29b
type: similar
- id: c740d4cf-a1e9-41de-bb16-8a46a4f57918
type: derived
status: test
description: This rule flags PowerShell process creation where the command line includes Enable-WindowsOptionalFeature with -Online and -FeatureName, and the feature name matches a set of potentially risky Windows optional features. Attackers can use Windows feature enablement to introduce new services or capabilities and expand persistence or access in environments where those components are not normally used. It relies on process creation telemetry, specifically the PowerShell command line contents.
references:
- https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
- https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
- https://learn.microsoft.com/en-us/windows/wsl/install-on-server
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_enable_susp_windows_optional_feature.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-29
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_cmd:
CommandLine|contains|all:
- Enable-WindowsOptionalFeature
- -Online
- -FeatureName
selection_feature:
CommandLine|contains:
- TelnetServer
- Internet-Explorer-Optional-amd64
- TFTP
- SMB1Protocol
- Client-ProjFS
- Microsoft-Windows-Subsystem-Linux
condition: all of selection_*
falsepositives:
- Legitimate usage of the features listed in the rule.
level: medium
license: DRL-1.1