huntrule

Windows Volume Shadow Copy Symlink Creation Using mklink

Flags Windows mklink commands that reference HarddiskVolumeShadowCopy to create symlinks.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Teymur Kheirkhabarov, oscd.community (SigmaHQ), DRL 1.1
Published
2019-10-22
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions where the command line includes both "mklink" and "HarddiskVolumeShadowCopy", indicating an attempt to create a symbolic link or related redirect targeting Volume Shadow Copy storage. Attackers can use this technique to access or manipulate shadow copy–backed data paths. Detection relies on Windows process creation telemetry capturing the full command line content.

Reporting behind it

Related detections9 linkedT1003.002 — drag to rearrange
Malicious Credential Hive Copy from Volume Shadow Copy
Windows Print.EXE Sensitive File Dump for Credential Access
Windows File Events: NTDS.DIT Created by Suspicious or Rare Process
Zeek SMB: Network Share File Transfers of Credential-Related Filenames
Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers
Windows Credential Dump Tool Artifacts Written to Disk via File Events
Windows Network Share File Transfers Targeting Credential and Memory Dump Paths
Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands
Windows: Detect esentutl.exe Copying Sensitive Credential Files via VSS
Windows Volume Shadow Copy Symlink Creation Using mklink
Pivot detection · T1003.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.