Date: 09/04/2024
Severity: High
Summary
Detects the use of DISM to activate the PowerShell Web Access feature, which might be exploited for remote access and potential misuse.
Indicators of Compromise (IOC) List
Image | '\dism.exe' |
OriginalFileName | 'DISM.EXE' |
CommandLine | 'WindowsPowerShellWebAccess' '/online' '/enable-feature' |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 | (((resourceName = "Sysmon" AND eventtype = "1" ) AND image = "\dism.exe" ) AND originalfilename = "DISM.EXE" ) AND commandline In ("WindowsPowerShellWebAccess" , "/online" , "/enable-feature") |
Detection Query 2 | (((Technologygroup = "EDR" ) AND image = "\dism.exe" ) AND originalfilename = "DISM.EXE" ) AND commandline In ("WindowsPowerShellWebAccess" , "/online" , "/enable-feature") |
Reference:
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dism_enable_powershell_web_access_feature.yml
https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41