Suspicious Windows Optional Feature Enablement via PowerShell
Detects the usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" with the '-Online' parameter to enable specific Windows optional features. This cmdlet is similar to DISM.exe and can be used to enumerate, install, uninstall, configure, and update features and packages in Windows images. The rule specifically looks for the enabling of potentially suspicious features like Telnet Server, Internet Explorer, TFTP Client, SMB1 Protocol, Client-ProjFS, and Microsoft-Windows-Subsystem-Linux.
Sigma
