Add Windows Capability Via PowerShell Script

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects the usage of the 'Add-WindowsCapability' PowerShell cmdlet, specifically looking for attempts to add Windows capabilities. It explicitly targets the addition of 'OpenSSH' related capabilities (both 'OpenSSH.Server' and 'OpenSSH.Client'). This activity could indicate an adversary attempting to install tools for remote access or other malicious purposes.