Shadow Copies Creation Using Operating System Utilities

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

This rule detects the creation of shadow copies using operating system utilities such as PowerShell, WMIC, or VSSAdmin. Adversaries often create shadow copies to access credential material, specifically the NTDS.dit file or SAM database, for offline analysis. The rule looks for specific executable names combined with command-line arguments containing 'shadow' and 'create'.