Copy From VolumeShadowCopy Via Cmd.EXE

SigmaHQ Detections@sigmaHQ

•updated Mar 7, 2023•0•0•0

Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)