Threat Huntmediumtest

Diskshadow Script Mode Execution

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Ivan Dyachkov, oscd.communityCreated Wed Oct 07Updated Wed Mar 130c2f8629-7129-4a8a-9897-7e0768f13ff2windows
Hunting Hypothesis
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - OriginalFileName: 'diskshadow.exe'
        - Image|endswith: '\diskshadow.exe'
    selection_cli:
        CommandLine|contains|windash: '-s '
    condition: all of selection_*
False Positives

Likely from legitimate backup scripts

MITRE ATT&CK
Rule Metadata
Rule ID
0c2f8629-7129-4a8a-9897-7e0768f13ff2
Status
test
Level
medium
Type
Threat Hunt
Created
Wed Oct 07
Modified
Wed Mar 13
Path
rules-threat-hunting/windows/process_creation/proc_creation_win_diskshadow_script_mode.yml
Raw Tags
attack.defense-evasionattack.t1218attack.executiondetection.threat-hunting
View on GitHub