Sensitive File Access Via Volume Shadow Copy Backup

SigmaHQ Detections@sigmaHQ

•updated Jan 18, 2024•0•0•0

Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)