Suspicious Proxy Execution through Vshadow (via process_creation)

title: Suspicious Proxy Execution through Vshadow (via process_creation)
id: 8bec64cb-991b-5f1e-ac13-154f3408c1de
status: stable
description: This rule detects the invocation of vshadow.exe with the -exec parameter that runs a specified script or command after the shadow copies are created but before the VShadow tool exits. VShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag, attackers can abuse this parameter to proxy the execution of malware.
author: Huntrule Team
date: 2026-06-18
references:
    - https://attack.mitre.org/techniques/T1202/
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
    - https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample
tags:
    - attack.stealth
    - attack.t1202
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\vshadow.exe'
        - OriginalFileName: 'vshadow.exe'
    selection_cli:
        CommandLine|contains: '-exec'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium