Hayabusa medium test sigma

Dism Remove Online Package

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_dismhost": {
    "Image
| endswith": "\\DismHost.exe",
    "ParentCommandLine
| contains
| all": [
      "/Online",
      "/Disable-Feature"
    ]
  },
  "selection_dism": {
    "Image
| endswith": "\\Dism.exe",
    "CommandLine
| contains
| all": [
      "/Online",
      "/Disable-Feature"
    ]
  },
  "condition": "process_creation and (1 of selection_*)"
}

False Positives

  • ⚠ Legitimate script

Field Validations

Loading…

Comments (0)

Loading comments...