Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands
Detects Windows processes using PowerShell/pwsh/wmic/vssadmin with shadow copy creation parameters.
- Product
- windows
- Category
- process_creation
- Author
- Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-22
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions on Windows that invoke system utilities associated with PowerShell, pwsh, wmic, or vssadmin and include command-line arguments indicating shadow copy creation. Attackers may use this technique to access or extract credential material from snapshots while avoiding direct access to live system files. Telemetry relies on Windows process creation events, including the executable image path and command-line content.
Reporting behind it
- slideshare.nethttps://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- trustwave.comhttps://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands
id: caa6065c-1f91-4f62-b9b4-7be083bbd1b0
status: test
description: This rule flags process executions on Windows that invoke system utilities associated with PowerShell, pwsh, wmic, or vssadmin and include command-line arguments indicating shadow copy creation. Attackers may use this technique to access or extract credential material from snapshots while avoiding direct access to live system files. Telemetry relies on Windows process creation events, including the executable image path and command-line content.
references:
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml
author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2022-11-10
tags:
- attack.credential-access
- attack.t1003
- attack.t1003.002
- attack.t1003.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- \wmic.exe
- \vssadmin.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
- wmic.exe
- VSSADMIN.EXE
selection_cli:
CommandLine|contains|all:
- shadow
- create
condition: all of selection_*
falsepositives:
- Legitimate administrator working with shadow copies, access for backup purposes
level: medium
license: DRL-1.1
related:
- id: b17ea6f7-6e90-447e-a799-e6c0a493d6ce
type: derived