Sigma rule: Add Windows Capability Via PowerShell Script
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-885da5ccccee, updated 2023-05-09T00:00:00.000Z.
Rule
- Title
- Add Windows Capability Via PowerShell Script
- Status
- test
- Level
- medium
- Author
- Nasreddine Bencherchali (Nextron Systems)
- Date
- 2023-01-22
- Modified
- 2023-05-09
- File
- rules/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.
Log source
- product
- windows
- category
- ps_script
- definition
- Requirements: Script Block Logging must be enabled
Detection
selection_cmdlet:
ScriptBlockText|contains: 'Add-WindowsCapability '
selection_capa:
ScriptBlockText|contains: '-Name OpenSSH.' # For both "OpenSSH.Server" and "OpenSSH.Client"
condition: all of selection_*False positives (as the rule lists them)
- Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly.
Tags
- attack.execution
Related rules
References
- https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell
- https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml
Sources and licences
SigmaHQ
"Add Windows Capability Via PowerShell Script" by Nasreddine Bencherchali (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Add Windows Capability Via PowerShell Script",
entity page, dataset version ref-885da5ccccee, updated 2023-05-09T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/155c7fd5-47b4-49b2-bbeb-eb4fab335429 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 155c7fd5-47b4-49b2-bbeb-eb4fab335429, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.