Disable-WindowsOptionalFeature Command PowerShell
This rule detects the execution of the PowerShell cmdlet `Disable-WindowsOptionalFeature` with specific parameters, indicating an attempt to disable Windows optional features. The rule specifically looks for the `-Online` and `-FeatureName` parameters, and then checks for common Windows Defender related feature names. This activity could be part of an adversary's defense evasion tactics to impair security tools.
Sigma
