Enable-WindowsOptionalFeature

Enables a feature in a Windows image. Windows Server PowerShell reference

From the Windows Server PowerShell reference 13 parameters 1 Sigma rule looks for it Its page in the reference

Parameters

13 in the Windows Server PowerShell reference

-AllEnables all parent features of the specified feature.

-FeatureNameSpecifies the name of the feature to be enabled.

-LimitAccessPrevents DISM from contacting Windows Update when searching for the source files to restore a feature on an online image.

-LogLevel, -LLSpecifies the maximum output level shown in the logs.

-LogPath, -LPSpecifies the full path and file name to log to.

-NoRestartSuppresses reboot.

-OnlineSpecifies that the action is to be taken on the operating system that is currently running on the local computer.

-PackageNameSpecifies the name of a package in the Windows image.

-PathSpecifies the full path to the root directory of the offline Windows image that you will service.

-ScratchDirectorySpecifies a temporary directory that will be used when extracting files for use during servicing.

-SourceSpecifies the location of the files that are required to restore a feature that has been removed from the image.

-SystemDriveSpecifies the path to the location of the BootMgr files.

-WindowsDirectorySpecifies the path to the Windows directory relative to the image path.

Sigma process creation rules that name Enable-WindowsOptionalFeature