PowerShell Web Access Feature Enabled Via DISM

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•23

This rule detects the use of the Deployment Image Servicing and Management (DISM) tool to enable the 'WindowsPowerShellWebAccess' feature. Adversaries may enable this feature to establish remote access to a system, potentially for persistence, privilege escalation, or further malicious activities. The detection specifically looks for `dism.exe` or `DISM.EXE` being executed with command-line arguments that include 'WindowsPowerShellWebAccess', '/online', and '/enable-feature'.