Windows Process Creation: Detects VSS Shadow Copy Listing via vssadmin

title: "Windows Process Creation: Detects VSS Shadow Copy Listing via vssadmin"
id: 4edce5d7-3d3f-45b8-bc87-bc9a6723a726
status: test
description: This rule flags Windows process executions whose command line includes both 'vssadmin list shadows' and 'log.txt'. Adversaries use volume shadow copy enumeration to discover recoverable backup snapshots before attempting deletion or tampering. The detection relies on process creation telemetry, specifically the full command line string captured at process start.
references:
  - https://twitter.com/vxunderground/status/1423336151860002816?s=20
  - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti.yml
author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-08-09
tags:
  - attack.t1587.001
  - attack.resource-development
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - vssadmin list shadows
      - log.txt
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7b30e0a7-c675-4b24-8a46-82fa67e2433d
    type: derived