Add Windows Capability Via PowerShell Cmdlet

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•15

Detects the usage of the "Add-WindowsCapability" PowerShell cmdlet to install Windows capabilities. This rule specifically highlights the installation of "OpenSSH" related capabilities, which could be used for remote access.