Dism Disable Online Feature
This rule detects the use of the Deployment Image Servicing and Management (DISM) tool, specifically 'Dism.exe' or 'DismHost.exe', with command-line arguments indicating an attempt to disable features or remove packages from a running Windows operating system ('/Online' and '/Disable-Feature'). This activity can be indicative of an adversary trying to impair defenses by disabling security features or removing security-related components.
Sigma
