Sigma rule: Add Windows Capability Via PowerShell Cmdlet
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-f498b85b8780, updated 2023-05-09T00:00:00.000Z.
Rule
- Title
- Add Windows Capability Via PowerShell Cmdlet
- Status
- test
- Level
- medium
- Author
- Nasreddine Bencherchali (Nextron Systems)
- Date
- 2023-01-22
- Modified
- 2023-05-09
- File
- rules/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.
Log source
- product
- windows
- category
- process_creation
Detection
selection_img:
- Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
selection_cmdlet:
CommandLine|contains: 'Add-WindowsCapability'
selection_capa:
CommandLine|contains: 'OpenSSH.' # For both "OpenSSH.Server" and "OpenSSH.Client"
condition: all of selection_*False positives (as the rule lists them)
- Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly.
Tags
- attack.execution
Related rules
References
- https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell
- https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml
Sources and licences
SigmaHQ
"Add Windows Capability Via PowerShell Cmdlet" by Nasreddine Bencherchali (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Add Windows Capability Via PowerShell Cmdlet",
entity page, dataset version ref-f498b85b8780, updated 2023-05-09T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/b36d01a3-ddaf-4804-be18-18a6247adfcd (accessed 2026-11-03).
Underlying source: SigmaHQ rule b36d01a3-ddaf-4804-be18-18a6247adfcd, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.