Disable-WindowsOptionalFeature Command PowerShell

SigmaHQ Detections@sigmaHQ

•updated Sep 1, 2026•6•0•14

Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images