Windows Command-Line Disables Volume Shadow Copy (VSS) Snapshots

title: Windows Command-Line Disables Volume Shadow Copy (VSS) Snapshots
id: 0ce426bc-87c3-41e1-a56a-db209745b515
status: test
description: This rule identifies Windows process executions whose command line references the VSS diagnostics service and includes the switch to disable snapshots. Attackers may impair backup and recovery capabilities by turning off Volume Shadow Copy, reducing defenders’ ability to restore data. The detection relies on process creation telemetry and matches specific command-line substrings indicating the targeted VSS component and the disable action.
references:
  - https://twitter.com/0gtweet/status/1354766164166115331
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_volsnap_disable.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-28
modified: 2023-12-15
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - \Services\VSS\Diag
      - /d Disabled
  condition: selection
falsepositives:
  - Legitimate administration
level: high
license: DRL-1.1
related:
  - id: dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a
    type: derived