All Detections

Windows Volume Shadow Copy Created via vssadmin

avatar
Danny Y@zendannyy
updated Jun 20, 2026006

Hunting rule: correlate with additional signals before alerting. Detects vssadmin shadow copy creation commonly preceding NTDS or SAM extraction.

Sigma