<<< Hide Navigation Hide TOC >>>
Disable-WindowsOptionalFeature Command PowerShell (99c4658d-2c5e-4d87-828d-7c066ca537c3)
Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
Cluster A![]() |
Galaxy A![]() |
Cluster B![]() |
Galaxy B![]() |
Level![]() |
---|---|---|---|---|
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) | Attack Pattern | Disable-WindowsOptionalFeature Command PowerShell (99c4658d-2c5e-4d87-828d-7c066ca537c3) | Sigma-Rules | 1 |
Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) | Attack Pattern | Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) | Attack Pattern | 2 |