Potential Suspicious Windows Feature Enabled - ProcCreation

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images