Disable-WindowsOptionalFeature Command PowerShell (99c4658d-2c5e-4d87-828d-7c066ca537c3)
Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Disable or Modify Tools - T1685 (bbde9781-60aa-4b8a-a911-895b0c1b3872) | Attack Pattern | Disable-WindowsOptionalFeature Command PowerShell (99c4658d-2c5e-4d87-828d-7c066ca537c3) | Sigma-Rules | 1 |