Windows: Detect Diskshadow.exe Spawning Child Processes

Alerts when Diskshadow.exe is the parent process of a newly created process on Windows.

FreeUnreviewedSigmamediumv1

windows-detect-diskshadow-exe-spawning-child-processes-56b1dde8

title: "Windows: Detect Diskshadow.exe Spawning Child Processes"
id: f42fb570-418b-451d-9c97-5afe711f1ac9
related:
  - id: fa1a7e52-3d02-435b-81b8-00da14dd66c1
    type: similar
  - id: 1dde5376-a648-492e-9e54-4241dd9b0c7f
    type: similar
  - id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8
    type: similar
  - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2
    type: similar
  - id: 56b1dde8-b274-435f-a73a-fb75eb81262a
    type: derived
status: test
description: This rule flags process creation events where the parent process image ends with '\diskshadow.exe', indicating Diskshadow launched another executable. Attackers may leverage Diskshadow interpreter/script execution and the exec capability to run additional tools, enabling stealthy execution chains. The detection relies on Windows process creation telemetry, using parent image path matching while excluding crashes involving WerFault.exe to reduce false positives.
references:
  - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_diskshadow_child_process.yml
author: Harjot Singh @cyb3rjy0t, Huntrule Team
date: 2023-09-15
tags:
  - attack.stealth
  - attack.t1218
  - attack.execution
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \diskshadow.exe
  filter_main_werfault:
    Image|endswith: :\Windows\System32\WerFault.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Likely from legitimate usage of Diskshadow in Interpreter mode.
level: medium
license: DRL-1.1

What it detects

This rule flags process creation events where the parent process image ends with '\diskshadow.exe', indicating Diskshadow launched another executable. Attackers may leverage Diskshadow interpreter/script execution and the exec capability to run additional tools, enabling stealthy execution chains. The detection relies on Windows process creation telemetry, using parent image path matching while excluding crashes involving WerFault.exe to reduce false positives.

Known false positives

Likely from legitimate usage of Diskshadow in Interpreter mode.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.