Windows: PowerShell Enable-WindowsOptionalFeature Enables Suspicious Optional Features

title: "Windows: PowerShell Enable-WindowsOptionalFeature Enables Suspicious Optional Features"
id: 18f3be5b-1e28-4211-a180-d9dfcf37862f
related:
  - id: 55c925c1-7195-426b-a136-a9396800e29b
    type: similar
  - id: c740d4cf-a1e9-41de-bb16-8a46a4f57918
    type: derived
status: test
description: This rule flags PowerShell process creation where the command line includes Enable-WindowsOptionalFeature with -Online and -FeatureName, and the feature name matches a set of potentially risky Windows optional features. Attackers can use Windows feature enablement to introduce new services or capabilities and expand persistence or access in environments where those components are not normally used. It relies on process creation telemetry, specifically the PowerShell command line contents.
references:
  - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
  - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
  - https://learn.microsoft.com/en-us/windows/wsl/install-on-server
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_enable_susp_windows_optional_feature.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-29
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains|all:
      - Enable-WindowsOptionalFeature
      - -Online
      - -FeatureName
  selection_feature:
    CommandLine|contains:
      - TelnetServer
      - Internet-Explorer-Optional-amd64
      - TFTP
      - SMB1Protocol
      - Client-ProjFS
      - Microsoft-Windows-Subsystem-Linux
  condition: all of selection_*
falsepositives:
  - Legitimate usage of the features listed in the rule.
level: medium
license: DRL-1.1