Windows Process Creation: Detects Volume Shadow Copy Listing via vssadmin
Alerts on Windows command lines that list VSS shadow copies and write results to log.txt.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-08-09
- Updated
- 2026-07-31
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions containing both the vssadmin command to list shadow copies and a log file argument. Attackers use Volume Shadow Copy discovery to identify backup artifacts that may be targeted for disruption or deletion. Detection relies on process creation telemetry capturing command-line content for the spawned process.
Reporting behind it
- twitter.comhttps://twitter.com/vxunderground/status/1423336151860002816?s=20
- virustotal.comhttps://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-detects-vss-shadow-copy-listing-via-vssadmin-7b30e0a7
title: "Windows Process Creation: Detects Volume Shadow Copy Listing via vssadmin"
id: 4edce5d7-3d3f-45b8-bc87-bc9a6723a726
status: test
description: This rule flags Windows process executions containing both the vssadmin command to list shadow copies and a log file argument. Attackers use Volume Shadow Copy discovery to identify backup artifacts that may be targeted for disruption or deletion. Detection relies on process creation telemetry capturing command-line content for the spawned process.
references:
- https://twitter.com/vxunderground/status/1423336151860002816?s=20
- https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti.yml
author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-08-09
tags:
- attack.t1587.001
- attack.resource-development
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- vssadmin list shadows
- log.txt
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7b30e0a7-c675-4b24-8a46-82fa67e2433d
type: derived