Windows vshadow.exe Proxy Execution via -exec Script/Command

Alerts when vshadow.exe is run with -exec, which can proxy execution of a script or command after shadow copy creation.

FreeUnreviewedSigmamediumv1

windows-vshadow-exe-proxy-execution-via-exec-script-command-d7c75059

title: Windows vshadow.exe Proxy Execution via -exec Script/Command
id: ddf58d50-b046-4933-afa3-839c9f8c8675
status: experimental
description: This rule flags process creation where vshadow.exe is invoked with a command line containing the -exec parameter. The -exec option runs a specified script or command after shadow copies are created and before vshadow exits, which can be abused to proxy execution. Telemetry relies on Windows process creation events capturing the executable identity (image/original filename) and the full command line.
author: David Faiss, Huntrule Team
date: 2025-05-26
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
  - https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vshadow_exec.yml
tags:
  - attack.stealth
  - attack.t1202
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \vshadow.exe
    - OriginalFileName: vshadow.exe
  selection_cli:
    CommandLine|contains: -exec
  condition: all of selection_*
falsepositives:
  - System backup or administrator tools
  - Legitimate administrative scripts
level: medium
license: DRL-1.1
related:
  - id: d7c75059-2901-4578-b209-8837fd31c6a8
    type: derived

What it detects

This rule flags process creation where vshadow.exe is invoked with a command line containing the -exec parameter. The -exec option runs a specified script or command after shadow copies are created and before vshadow exits, which can be abused to proxy execution. Telemetry relies on Windows process creation events capturing the executable identity (image/original filename) and the full command line.

Known false positives

System backup or administrator tools
Legitimate administrative scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.