Dism Remove Online Package

Title: Dism Remove Online Package
Status: test
Description:Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-26---disable-windows-defender-with-dism
  -https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html
Author: frack113
Date: 2022-01-16
modified:2022-08-26
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_dismhost:
    Image|endswith: '\DismHost.exe'
    ParentCommandLine|contains|all:
      -'/Online'
      -'/Disable-Feature'

  selection_dism:
    Image|endswith: '\Dism.exe'
    CommandLine|contains|all:
      -'/Online'
      -'/Disable-Feature'

  condition:1 of selection_*
Falsepositives:
  -Legitimate script
Level: medium