Potential Suspicious Windows Feature Enabled via PowerShell
Detects the use of the PowerShell cmdlet "Enable-WindowsOptionalFeature" to enable potentially suspicious or insecure Windows features. This cmdlet functions similarly to DISM.exe for managing Windows features and packages. The rule specifically looks for the enablement of features like Telnet Server, Internet Explorer (optional), TFTP, SMB1 Protocol, Client-ProjFS, and Windows Subsystem for Linux, which might be enabled by adversaries for various purposes or represent a security risk if not intentionally used.
Sigma
