{"id":"43e32da2-fdd0-4156-90de-50dfd62636f9","title":"Dism Remove Online Package","description":"Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images","author":"frack113","status":"test","level":"medium","date":"2022-01-16","modified":"2022-08-26","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate script"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-26---disable-windows-defender-with-dism","https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html"],"source_path":"rules/windows/process_creation/proc_creation_win_dism_remove.yml","source_sha256":"2d990cacac9d667cd94a9337ebaaa8e4bb34c0d64773eb657533097987db571d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dism_remove.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Dism Remove Online Package\nid: 43e32da2-fdd0-4156-90de-50dfd62636f9\nstatus: test\ndescription: Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-26---disable-windows-defender-with-dism\n    - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html\nauthor: frack113\ndate: 2022-01-16\nmodified: 2022-08-26\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_dismhost:\n        Image|endswith: '\\DismHost.exe'\n        ParentCommandLine|contains|all:\n            - '/Online'\n            - '/Disable-Feature'\n            # - '/FeatureName:'\n            # - '/Remove'\n            # /NoRestart\n            # /quiet\n    selection_dism:\n        Image|endswith: '\\Dism.exe'\n        CommandLine|contains|all:\n            - '/Online'\n            - '/Disable-Feature'\n            # - '/FeatureName:'\n            # - '/Remove'\n            # /NoRestart\n            # /quiet\n    condition: 1 of selection_*\nfalsepositives:\n    - Legitimate script\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dism_remove/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Disable Windows Defender with DISM\n      technique: T1562.001\n      atomic_guid: 871438ac-7d6e-432a-b27d-3e7db69faf58\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/43e32da2-fdd0-4156-90de-50dfd62636f9.json","kind":"sigma"}