Windows Volume Shadow Copy Symlink Creation Using mklink

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.002Security Account Manager
- T1003.003NTDS
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions where the command line includes both "mklink" and "HarddiskVolumeShadowCopy", indicating an attempt to create a symbolic link or related redirect targeting Volume Shadow Copy storage. Attackers can use this technique to access or manipulate shadow copy–backed data paths. Detection relies on Windows process creation telemetry capturing the full command line content.

Reporting behind it

Related detections9 linkedT1003.002 — drag to rearrange

Malicious Credential Hive Copy from Volume Shadow Copy

Windows Print.EXE Sensitive File Dump for Credential Access

Windows File Events: NTDS.DIT Created by Suspicious or Rare Process

Zeek SMB: Network Share File Transfers of Credential-Related Filenames

Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers

Windows Credential Dump Tool Artifacts Written to Disk via File Events

Windows Network Share File Transfers Targeting Credential and Memory Dump Paths

Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands

Windows: Detect esentutl.exe Copying Sensitive Credential Files via VSS

Windows Volume Shadow Copy Symlink Creation Using mklink

Pivot detection · T1003.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-volume-shadow-copy-symlink-creation-using-mklink-40b19fa6

title: Windows Volume Shadow Copy Symlink Creation Using mklink
id: 0569c496-9886-492b-8ca5-80d73c9d9068
status: stable
description: This rule flags process executions where the command line includes both "mklink" and "HarddiskVolumeShadowCopy", indicating an attempt to create a symbolic link or related redirect targeting Volume Shadow Copy storage. Attackers can use this technique to access or manipulate shadow copy–backed data paths. Detection relies on Windows process creation telemetry capturing the full command line content.
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_mklink_shadow_copies_access_symlink.yml
author: Teymur Kheirkhabarov, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2023-03-06
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - mklink
      - HarddiskVolumeShadowCopy
  condition: selection
falsepositives:
  - Legitimate administrator working with shadow copies, access for backup purposes
level: high
license: DRL-1.1
related:
  - id: 40b19fa6-d835-400c-b301-41f3a2baacaf
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL