Diskshadow Child Process Spawned
Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications. Adversaries may use Diskshadow.exe to proxy execution of other commands or to inhibit system recovery by deleting shadow copies.
Sigma
