Windows Volume Shadow Copy Symlink Creation Using mklink

title: Windows Volume Shadow Copy Symlink Creation Using mklink
id: 0569c496-9886-492b-8ca5-80d73c9d9068
status: stable
description: Detects creation of a symbolic link targeting the Volume Shadow Copy storage path by matching Windows process command lines containing both mklink and HarddiskVolumeShadowCopy. This behavior matters because attackers may use Volume Shadow Copy-related paths to access or stage data for credential access. The rule relies on process creation telemetry and command-line contents from Windows.
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_mklink_shadow_copies_access_symlink.yml
author: Teymur Kheirkhabarov, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2023-03-06
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - mklink
      - HarddiskVolumeShadowCopy
  condition: selection
falsepositives:
  - Legitimate administrator working with shadow copies, access for backup purposes
level: high
license: DRL-1.1
related:
  - id: 40b19fa6-d835-400c-b301-41f3a2baacaf
    type: derived