Windows Security: VSSAudit Event Source Registration (Event ID 4904/4905)

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.002Security Account Manager
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows Security log events where the AuditSourceName is set to VSSAudit and the EventID is 4904 or 4905, indicating registration of the VSSAudit security event source. Attackers may leverage event source registration to affect auditing behavior or cover tracks around volume shadow copy activity. The detection relies on Windows Security telemetry fields including AuditSourceName and EventID.

Reporting behind it

Related detections9 linkedT1003.002 — drag to rearrange

Credential Dumping via Reg Save of SAM Hive

Malicious Registry Hive Dump via reg save

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Malicious Registry Hive Dump of SAM or SYSTEM via Reg Save (via process_creation)

Malicious Credential Hive Copy from Volume Shadow Copy

Malicious Secretdump Password Dumping via SMB Admin Share (via security)

Malicious Registry Hive Dump of SAM and SYSTEM via Reg Save (via process_creation)

Suspicious SAM Registry Hive Dump to Windows Temp by BianLian

Malicious SAM and SYSTEM Hive Dump via reg save (via process_creation)

Windows Security: VSSAudit Event Source Registration (Event ID 4904/4905)

Pivot detection · T1003.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-vssaudit-security-event-source-registration-event-ids-4904-4905-e9faba72

title: "Windows Security: VSSAudit Event Source Registration (Event ID 4904/4905)"
id: 5bbdefa0-a3e8-48d2-b42d-42da630ae525
status: test
description: This rule matches Windows Security log events where the AuditSourceName is set to VSSAudit and the EventID is 4904 or 4905, indicating registration of the VSSAudit security event source. Attackers may leverage event source registration to affect auditing behavior or cover tracks around volume shadow copy activity. The detection relies on Windows Security telemetry fields including AuditSourceName and EventID.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_vssaudit_secevent_source_registration.yml
author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), Huntrule Team
date: 2020-10-20
modified: 2022-04-28
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  product: windows
  service: security
detection:
  selection:
    AuditSourceName: VSSAudit
    EventID:
      - 4904
      - 4905
  condition: selection
falsepositives:
  - Legitimate use of VSSVC. Maybe backup operations. It would usually be done by C:\Windows\System32\VSSVC.exe.
level: informational
license: DRL-1.1
related:
  - id: e9faba72-4974-4ab2-a4c5-46e25ad59e9b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL