Windows PowerShell Web Access enabled via DISM

Flags DISM executions that enable the WindowsPowerShellWebAccess feature using /online and /enable-feature parameters.

FreeUnreviewedSigmahighv1

windows-powershell-web-access-enabled-via-dism-7e8f2d3b

title: Windows PowerShell Web Access enabled via DISM
id: 237512ea-7cb0-4776-b601-5815b2f88f96
status: test
description: This rule identifies Windows systems where DISM is used with specific parameters to enable the Windows PowerShell Web Access feature. Attackers may leverage Web Access to establish remote management or enable additional persistence. It relies on process creation telemetry capturing DISM execution where the command line includes the Web Access feature name along with the /online and /enable-feature options.
references:
  - https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
  - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dism_enable_powershell_web_access_feature.yml
author: Michael Haag, Huntrule Team
date: 2024-09-03
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \dism.exe
    - OriginalFileName: DISM.EXE
  selection_cli:
    CommandLine|contains|all:
      - WindowsPowerShellWebAccess
      - /online
      - /enable-feature
  condition: all of selection_*
falsepositives:
  - Legitimate PowerShell Web Access installations by administrators
level: high
license: DRL-1.1
related:
  - id: 7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f
    type: derived

What it detects

This rule identifies Windows systems where DISM is used with specific parameters to enable the Windows PowerShell Web Access feature. Attackers may leverage Web Access to establish remote management or enable additional persistence. It relies on process creation telemetry capturing DISM execution where the command line includes the Web Access feature name along with the /online and /enable-feature options.

Known false positives

Legitimate PowerShell Web Access installations by administrators

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.