Esentutl Volume Shadow Copy Service Keys

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.