PowerShell Web Access Feature Enabled Via DISM

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Michael Haag
Source: github.com/SigmaHQ/sigma

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

Known false positives

Legitimate PowerShell Web Access installations by administrators

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: PowerShell Web Access Feature Enabled Via DISM
id: 7e8f2d3b-9c1a-4f67-b9e8-8d9006e0e51f
status: test
description: Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse
references:
    - https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
    - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
author: Michael Haag
date: 2024-09-03
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\dism.exe'
        - OriginalFileName: 'DISM.EXE'
    selection_cli:
        CommandLine|contains|all:
            - 'WindowsPowerShellWebAccess'
            - '/online'
            - '/enable-feature'
    condition: all of selection_*
falsepositives:
    - Legitimate PowerShell Web Access installations by administrators
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\dism.exe'
    - OriginalFileName: 'DISM.EXE'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|all:
        - 'WindowsPowerShellWebAccess'
        - '/online'
        - '/enable-feature'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/enable-feature` corpus 2 (sigma 1, splunk 1) `/online` corpus 4 (sigma 2, splunk 2) `WindowsPowerShellWebAccess` corpus 2 (sigma 1, splunk 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\dism.exe` corpus 6 (sigma 6)	`field:"Image" kind:ends_with value:"\dism.exe"`
`OriginalFileName`	eq	`DISM.EXE` corpus 3 (elastic 2, sigma 1)	`field:"OriginalFileName" kind:eq value:"DISM.EXE"`

PowerShell Web Access Feature Enabled Via DISM

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli

Indicators

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli`