CmdID

CmdID / PowerShell / Cmdlets / Uninstall

Uninstall-WindowsFeature

Uninstalls specified Windows Server roles, role services, and features from a computer that is running Windows Server 2012 R2. Windows Server PowerShell reference

From the Windows Server PowerShell reference 10 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

10 in the Windows Server PowerShell reference
-ComputerName, -CnSpecifies the remote computer for which this cmdlet uninstalls and optionally removes one or more rrsandf_plural.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-CredentialSpecifies a user account that has access rights to perform this action.
-IncludeManagementToolsIndicates that the cmdlet uninstalls all applicable management tools along with the roles, role services, or features that are specified in the *Name* parameter.
-LogPathSpecifies a name and path to a log file.
-NameSpecifies a list of features that this cmdlet uninstalls.
-RemoveIndicates that the cmdlet deletes feature files for the specified rrsandf_plural from the side-by-side store, located at %SystemDrive%:\Windows\WinSxS.
-RestartIndicates that this cmdlet automatically restarts the target computer, if a restart is required by the uninstallation process for the specified roles or features.
-VhdSpecifies the path to an offline VHD.
-WhatIf, -wiShows what would happen if the cmdlet runs.

What looks for it

Sigma process creation rules that name Uninstall-WindowsFeature
highSuspicious Uninstall of Windows Defender Feature via PowerShellyxinmiracle