Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands

title: Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands
id: caa6065c-1f91-4f62-b9b4-7be083bbd1b0
status: test
description: This rule flags process executions on Windows that invoke system utilities associated with PowerShell, pwsh, wmic, or vssadmin and include command-line arguments indicating shadow copy creation. Attackers may use this technique to access or extract credential material from snapshots while avoiding direct access to live system files. Telemetry relies on Windows process creation events, including the executable image path and command-line content.
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml
author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2022-11-10
tags:
  - attack.credential-access
  - attack.t1003
  - attack.t1003.002
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
        - \wmic.exe
        - \vssadmin.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
        - wmic.exe
        - VSSADMIN.EXE
  selection_cli:
    CommandLine|contains|all:
      - shadow
      - create
  condition: all of selection_*
falsepositives:
  - Legitimate administrator working with shadow copies, access for backup purposes
level: medium
license: DRL-1.1
related:
  - id: b17ea6f7-6e90-447e-a799-e6c0a493d6ce
    type: derived