Diskshadow Script Mode - Uncommon Script Extension Execution
Detects the execution of "Diskshadow.exe" in script mode with a potentially uncommon script extension. This rule requires initial baselining of allowed script extensions to minimize false positives. Adversaries may use Diskshadow.exe, a legitimate Windows utility, to proxy execution of malicious scripts, often as a defense evasion technique.
Sigma
