Detectionmediumtest

Add Windows Capability Via PowerShell Script

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Sun Jan 22Updated Tue May 09155c7fd5-47b4-49b2-bbeb-eb4fab335429windows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection_cmdlet:
        ScriptBlockText|contains: 'Add-WindowsCapability '
    selection_capa:
        ScriptBlockText|contains: '-Name OpenSSH.' # For both "OpenSSH.Server" and "OpenSSH.Client"
    condition: all of selection_*

False Positives

Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly.

References

MITRE ATT&CK

Tactics

TA0002 · Execution

Related Rules

SimilarDetectionmedium

Add Windows Capability Via PowerShell Cmdlet

Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

155c7fd5-47b4-49b2-bbeb-eb4fab335429

Status

test

Level

medium

Type

Detection

Created

Sun Jan 22

Modified

Tue May 09

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml

Raw Tags

attack.execution

View on GitHub