Suspicious Use of Diskshadow by Privileged Account

Michael Fajkus@MilesDyson

•updated Jul 30, 2025•2•1•42

This detection identifies instances where the diskshadow.exe utility is executed by a privileged user shortly after a successful logon. diskshadow.exe is a legitimate tool often abused by attackers for shadow copy manipulation and data exfiltration. Monitoring its use by privileged accounts helps identify potential malicious activity.