CmdID

CmdID / PowerShell / Cmdlets / Add

Add-WindowsCapability

Installs a Windows capability package on the specified operating system image. Windows Server PowerShell reference

From the Windows Server PowerShell reference 10 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

10 in the Windows Server PowerShell reference
-LimitAccessIndicates that this cmdlet does not query Windows Update for source packages when servicing a live OS.
-LogLevel, -LLSpecifies the maximum output level shown in the logs.
-LogPath, -LPSpecifies the full path and file name to log to.
-NameSpecifies the identity of the capability to add to an operating system image.
-OnlineIndicates that the cmdlet operates on a running operating system on the local host.
-PathSpecifies the full path to the root directory of the offline Windows image that you will service.
-ScratchDirectorySpecifies a temporary directory that will be used when extracting files for use during servicing.
-SourceSpecifies the location of the files that are required to add a Windows capability package to an image.
-SystemDriveSpecifies the path to the location of the BootMgr files.
-WindowsDirectorySpecifies the path to the Windows directory relative to the image path.

What looks for it

Sigma process creation rules that name Add-WindowsCapability
mediumAdd Windows Capability Via PowerShell CmdletNasreddine Bencherchali (Nextron Systems)