Windows: Detect Volume Shadow Copy (VSS) Mount via NTFS Event 98

title: "Windows: Detect Volume Shadow Copy (VSS) Mount via NTFS Event 98"
id: 0ba2750e-22a2-4d2d-9120-532a7ca218a2
status: test
description: This rule identifies Windows volume shadow copy mounts by matching Microsoft-Windows-Ntfs system events where EventID 98 is logged and DeviceName contains HarddiskVolumeShadowCopy. Volume shadow copies can be used by attackers to access data or snapshots without interacting with the original volumes. The detection relies on Windows System event telemetry from the NTFS provider and the presence of the VSS device naming pattern in DeviceName.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_ntfs/win_system_volume_shadow_copy_mount.yml
author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), Huntrule Team
date: 2020-10-20
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Microsoft-Windows-Ntfs
    EventID: 98
    DeviceName|contains: HarddiskVolumeShadowCopy
  condition: selection
falsepositives:
  - Legitimate use of volume shadow copy mounts (backups maybe).
level: low
license: DRL-1.1
related:
  - id: f512acbf-e662-4903-843e-97ce4652b740
    type: derived