Proxy Execution via Vshadow with -exec Parameter
This rule detects the execution of 'vshadow.exe' with the '-exec' parameter. The VShadow tool is used to create and manage volume shadow copies, and the '-exec' parameter allows for the execution of a specified script or command after shadow copies are created but before VShadow exits. While this functionality can be used legitimately for backup or administrative tasks, attackers can abuse it to proxy the execution of malicious code, thereby bypassing security controls or achieving defense evasion.
Sigma
