sigmahighHunting

PowerShell Web Access Feature Enabled Via DISM

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

MITRE ATT&CK

T1548.002

privilege-escalationdefense-evasionpersistence

Detection Query

selection_img:
  - Image|endswith: \dism.exe
  - OriginalFileName: DISM.EXE
selection_cli:
  CommandLine|contains|all:
    - WindowsPowerShellWebAccess
    - /online
    - /enable-feature
condition: all of selection_*

Author

Michael Haag

Created

2024-09-03

Data Sources

windowsProcess Creation Events

Platforms

windows

References

Tags

attack.privilege-escalationattack.defense-evasionattack.persistenceattack.t1548.002

Raw Content

title: PowerShell Web Access Feature Enabled Via DISM
id: 7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f
status: test
description: Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse
references:
    - https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
    - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
author: Michael Haag
date: 2024-09-03
tags:
    - attack.privilege-escalation
    - attack.defense-evasion
    - attack.persistence
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\dism.exe'
        - OriginalFileName: 'DISM.EXE'
    selection_cli:
        CommandLine|contains|all:
            - 'WindowsPowerShellWebAccess'
            - '/online'
            - '/enable-feature'
    condition: all of selection_*
falsepositives:
    - Legitimate PowerShell Web Access installations by administrators
level: high