PowerShell Creates Volume Shadow Copy via Win32_ShadowCopy Class

Alerts when PowerShell script blocks invoke Win32_ShadowCopy.Create to create a ClientAccessible shadow copy.

FreeUnreviewedSigmahighv1

powershell-creates-volume-shadow-copy-via-win32-shadowcopy-class-afd12fed

title: PowerShell Creates Volume Shadow Copy via Win32_ShadowCopy Class
id: 80e07d7f-37b2-4e3b-89b6-83126f541003
status: test
description: This rule flags PowerShell script block content that references the Win32_ShadowCopy WMI class and calls the Create method with parameters including ClientAccessible. Attackers can use shadow copies to obtain or access sensitive files offline, which can support credential theft objectives such as targeting Active Directory data. It relies on PowerShell Script Block Logging telemetry capturing the script text executed in the process.
references:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml
author: frack113, Huntrule Team
date: 2022-01-12
tags:
  - attack.credential-access
  - attack.t1003.003
  - attack.ds0005
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Win32_ShadowCopy
      - ).Create(
      - ClientAccessible
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: high
license: DRL-1.1
related:
  - id: afd12fed-b0ec-45c9-a13d-aa86625dac81
    type: derived

What it detects

This rule flags PowerShell script block content that references the Win32_ShadowCopy WMI class and calls the Create method with parameters including ClientAccessible. Attackers can use shadow copies to obtain or access sensitive files offline, which can support credential theft objectives such as targeting Active Directory data. It relies on PowerShell Script Block Logging telemetry capturing the script text executed in the process.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.