PowerShell Web Access Feature Enabled Via DISM — Sigma Rule

Rule metadata and linked tags

Author: Michael Haag. Source status: test; severity: high. Source dates: 2024-09-03 / not supplied.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 51de13392e2b0a9ad6328e5bfa0172d6bdefa2777d77eb53efb613d6b997f334

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: PowerShell Web Access Feature Enabled Via DISM
id: 7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f
status: test
description: Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse
references:
    - https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
    - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
author: Michael Haag
date: 2024-09-03
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\dism.exe'
        - OriginalFileName: 'DISM.EXE'
    selection_cli:
        CommandLine|contains|all:
            - 'WindowsPowerShellWebAccess'
            - '/online'
            - '/enable-feature'
    condition: all of selection_*
falsepositives:
    - Legitimate PowerShell Web Access installations by administrators
level: high

Original YAML and metadata in JSON

False positives

• Legitimate PowerShell Web Access installations by administrators

Source references

• https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature
• https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
• https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41