Windows Security: VSSAudit Security Event Source Registration (Event IDs 4904/4905)

Alerts on VSSAudit security event source registration in Windows Security logs using Event IDs 4904/4905.

FreeUnreviewedSigmainformationalv1

windows-security-vssaudit-security-event-source-registration-event-ids-4904-4905-e9faba72

title: "Windows Security: VSSAudit Security Event Source Registration (Event IDs 4904/4905)"
id: 5bbdefa0-a3e8-48d2-b42d-42da630ae525
status: test
description: This rule catches Windows Security events where the security event source name is registered as VSSAudit, specifically for Event IDs 4904 and 4905. Attackers may use event source registration to enable or facilitate activity monitoring and collection tied to volume shadow copy related operations. The detection relies on Windows Security log telemetry containing AuditSourceName and matching Event ID values.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_vssaudit_secevent_source_registration.yml
author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), Huntrule Team
date: 2020-10-20
modified: 2022-04-28
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  product: windows
  service: security
detection:
  selection:
    AuditSourceName: VSSAudit
    EventID:
      - 4904
      - 4905
  condition: selection
falsepositives:
  - Legitimate use of VSSVC. Maybe backup operations. It would usually be done by C:\Windows\System32\VSSVC.exe.
level: informational
license: DRL-1.1
related:
  - id: e9faba72-4974-4ab2-a4c5-46e25ad59e9b
    type: derived

What it detects

This rule catches Windows Security events where the security event source name is registered as VSSAudit, specifically for Event IDs 4904 and 4905. Attackers may use event source registration to enable or facilitate activity monitoring and collection tied to volume shadow copy related operations. The detection relies on Windows Security log telemetry containing AuditSourceName and matching Event ID values.

Known false positives

Legitimate use of VSSVC. Maybe backup operations. It would usually be done by C:\Windows\System32\VSSVC.exe.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.