Windows Process Creation: Suspicious Child Processes Spawned by Diskshadow.exe

Alerts on process creation where Diskshadow.exe spawns certutil, cscript, mshta, PowerShell, regsvr32, rundll32, or wscript.

FreeUnreviewedSigmamediumv1

windows-process-creation-suspicious-child-processes-spawned-by-diskshadow-exe-9f546b25

title: "Windows Process Creation: Suspicious Child Processes Spawned by Diskshadow.exe"
id: 8ddfe84e-7ffe-4259-a97c-ccb979a34de2
related:
  - id: fa1a7e52-3d02-435b-81b8-00da14dd66c1
    type: similar
  - id: 1dde5376-a648-492e-9e54-4241dd9b0c7f
    type: similar
  - id: 56b1dde8-b274-435f-a73a-fb75eb81262a
    type: similar
  - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2
    type: similar
  - id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8
    type: derived
status: test
description: This rule flags Windows process creation events where a child process is spawned by Diskshadow.exe and the child executable matches a list of commonly abused binaries. Attackers may use Diskshadow to launch other tools in order to evade parent/child relationship visibility or bypass application allowlisting. The detection relies on process creation telemetry with parent and child image paths, using suffix matching to identify Diskshadow.exe and the targeted child executables.
references:
  - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow
  - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
  - https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware
  - https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_diskshadow_child_process_susp.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-15
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \diskshadow.exe
    Image|endswith:
      - \certutil.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wscript.exe
  condition: selection
falsepositives:
  - False postitve can occur in cases where admin scripts levreage the "exec" flag to execute applications
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation events where a child process is spawned by Diskshadow.exe and the child executable matches a list of commonly abused binaries. Attackers may use Diskshadow to launch other tools in order to evade parent/child relationship visibility or bypass application allowlisting. The detection relies on process creation telemetry with parent and child image paths, using suffix matching to identify Diskshadow.exe and the targeted child executables.

Known false positives

False postitve can occur in cases where admin scripts levreage the "exec" flag to execute applications

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.