Windows vshadow.exe Proxy Execution via -exec Script/Command
Alerts when vshadow.exe is run with -exec, which can proxy execution of a script or command after shadow copy creation.
- Product
- windows
- Category
- process_creation
- Author
- David Faiss (SigmaHQ), DRL 1.1
- Published
- 2025-05-26
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where vshadow.exe is invoked with a command line containing the -exec parameter. The -exec option runs a specified script or command after shadow copies are created and before vshadow exits, which can be abused to proxy execution. Telemetry relies on Windows process creation events capturing the executable identity (image/original filename) and the full command line.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vshadow_exec.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows vshadow.exe Proxy Execution via -exec Script/Command
id: ddf58d50-b046-4933-afa3-839c9f8c8675
status: experimental
description: This rule flags process creation where vshadow.exe is invoked with a command line containing the -exec parameter. The -exec option runs a specified script or command after shadow copies are created and before vshadow exits, which can be abused to proxy execution. Telemetry relies on Windows process creation events capturing the executable identity (image/original filename) and the full command line.
author: David Faiss, Huntrule Team
date: 2025-05-26
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
- https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vshadow_exec.yml
tags:
- attack.stealth
- attack.t1202
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \vshadow.exe
- OriginalFileName: vshadow.exe
selection_cli:
CommandLine|contains: -exec
condition: all of selection_*
falsepositives:
- System backup or administrator tools
- Legitimate administrative scripts
level: medium
license: DRL-1.1
related:
- id: d7c75059-2901-4578-b209-8837fd31c6a8
type: derived