PowerShell Web Access Feature Enabled Via DISM

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse