Volume Shadow Copy Mount Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

This rule detects the mounting of a volume shadow copy, specifically looking for Event ID 98 from the Microsoft-Windows-Ntfs provider where the DeviceName contains 'HarddiskVolumeShadowCopy'. Adversaries may mount volume shadow copies to access files, including credential stores like the Security Account Manager (SAM) database, without directly interacting with the live file system, which can bypass some security controls.