VSSAudit Security Event Source Registration

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the registration of the VSSAudit security event source, which typically occurs during volume shadow copy operations. This can be indicative of credential dumping attempts, specifically targeting the Security Account Manager (SAM) database.