Diskshadow Script Mode Execution
Detects the execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that delete shadow copies on systems, which can be a defense evasion technique to prevent system recovery. The rule identifies instances where diskshadow.exe is launched with the script execution flag.
Sigma
