Diskshadow Script Mode - Uncommon Script Extension Execution
Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_img:
- OriginalFileName: 'diskshadow.exe'
- Image|endswith: '\diskshadow.exe'
selection_flag:
CommandLine|contains|windash: '-s '
filter_main_ext:
# Note: can be changed to an "endswith" to avoid rare FPs. But you need to account for quoted paths
# Note: Using the ".txt" is based on the MS documentation example. Best add the extension you use internally before using this rule
CommandLine|contains: '.txt'
condition: all of selection_* and not 1 of filter_main_*False postitve might occur with legitimate or uncommon extensions used internally. Initial baseline is required.
Tactics
Techniques
Diskshadow Script Mode - Execution From Potential Suspicious Location
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.
Detects similar activity. Both rules may fire on overlapping events.
Potentially Suspicious Child Process Of DiskShadow.EXE
Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt to bypass parent/child relationship detection or application whitelisting rules.
Detects similar activity. Both rules may fire on overlapping events.
Diskshadow Child Process Spawned
Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications.
Detects similar activity. Both rules may fire on overlapping events.
Diskshadow Script Mode Execution
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.
Detects similar activity. Both rules may fire on overlapping events.