Detectionhighstable

VolumeShadowCopy Symlink Creation Via Mklink

Shadow Copies storage symbolic link creation using operating systems utilities

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Teymur Kheirkhabarov, oscd.communityCreated Tue Oct 22Updated Mon Mar 0640b19fa6-d835-400c-b301-41f3a2baacafwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains|all:
            - 'mklink'
            - 'HarddiskVolumeShadowCopy'
    condition: selection

False Positives

Legitimate administrator working with shadow copies, access for backup purposes

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

40b19fa6-d835-400c-b301-41f3a2baacaf

Status

stable

Level

high

Type

Detection

Created

Tue Oct 22

Modified

Mon Mar 06

Author

Path

rules/windows/process_creation/proc_creation_win_cmd_mklink_shadow_copies_access_symlink.yml

Raw Tags

attack.credential-accessattack.t1003.002attack.t1003.003