Abuse of PowerShell Disable-WindowsOptionalFeature for Defense Impairment

The Disable-WindowsOptionalFeature PowerShell cmdlet, a native component of the Deployment Image Servicing and Management (DISM) toolset, is increasingly targeted by adversaries to disable critical Windows security features. By invoking this cmdlet with the -Online and -FeatureName parameters, attackers can programmatically remove or disable built-in services, specifically targeting Windows Defender GUI, features, and application guard components. This technique is part of a broader class of defense impairment where attackers modify system state to reduce visibility or eliminate protective software. As a legitimate administrative function, its misuse often blends with standard system maintenance, making detection dependent on monitoring PowerShell Script Block Logging (Event ID 4104) for specific cmdlet signatures combined with sensitive feature names.

Attack Chain

1. Initial access is established through a compromised account or social engineering.
2. The attacker gains execution privileges as an administrator, which is required to modify system features.
3. The attacker identifies the target security feature to be disabled (e.g., Windows-Defender).
4. PowerShell is invoked to execute the Disable-WindowsOptionalFeature cmdlet.
5. The -Online parameter is used to target the currently running operating system instance.
6. The -FeatureName parameter specifies the security component to be disabled.
7. The system process modifications are processed by the DISM subsystem.
8. Final objective of defense impairment is achieved, allowing for subsequent malicious activities without detection by local security software.

Impact

Successful exploitation of this technique results in the complete or partial disabling of built-in Windows security mechanisms. This increases the exposure of the host to further malicious activities, as security tooling (like Windows Defender) is rendered inactive, facilitating long-term persistence and unauthorized data exfiltration.

Recommendation

Detection engineers should prioritize the visibility of administrative command-line execution and PowerShell script usage.

• Enable PowerShell Script Block Logging (Event ID 4104) to capture the full command syntax.
• Deploy the provided Sigma rule to monitor for suspicious disabling of security-related feature names.
• Audit administrative access policies to ensure that only authorized personnel can execute modification cmdlets.