Possible VSSAudit Security Event Source Registration (via security)

title: Possible VSSAudit Security Event Source Registration (via security)
id: a4a49042-a5ac-53ad-96b8-be0c087beeac
status: stable
description: This rule detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
references:
    - https://attack.mitre.org/techniques/T1003/002/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
author: Huntrule Team
date: 2026-05-25
tags:
    - attack.credential-access
    - attack.t1003.002
logsource:
    product: windows
    service: security
detection:
    selection:
        AuditSourceName: VSSAudit
        EventID:
            - 4904
            - 4905
    condition: selection
falsepositives:
    - Unknown
level: informational