Every published rule

Windows vshadow.exe Proxy Execution via -exec Script/Command

Alerts when vshadow.exe is run with -exec, which can proxy execution of a script or command after shadow copy creation.

Windows Image Load: Uncommon VSSAPI DLL (vssapi.dll) by Suspicious Executables

Alerts when uncommon processes load vssapi.dll, a Shadow Copy–related DLL, using image load telemetry with path-based exclusions.

Windows PowerShell WMI Volume Shadow Copy Deletion

Flags PowerShell WMI/CIM commands that query Win32_ShadowCopy and attempt deletion.

PowerShell Script Creates Volume Shadow Copy via Win32_ShadowCopy

Alerts when PowerShell script blocks invoke Win32_ShadowCopy.Create to create a ClientAccessible shadow copy.

Windows Process Creation: Detects Volume Shadow Copy Listing via vssadmin

Alerts on Windows command lines that list VSS shadow copies and write results to log.txt.

PowerShell SAM Hive Copy via Volume Shadow Copy Paths on Windows

Flags PowerShell commands that copy the SAM hive from Volume Shadow Copy locations using .NET or PowerShell copy semantics.

Windows WMI Shadow Copy Deletion via PowerShell

Identifies PowerShell commands that use WMI Win32_ShadowCopy to delete or remove Volume Shadow Copies.

Windows Command-Line Disables Volume Shadow Copy (VSS) Snapshots

Flags Windows command lines that disable Volume Shadow Copy (VSS) snapshots via VSS Diag service switches.

Windows Event Log Detects Volume Shadow Copy Mounts (HarddiskVolumeShadowCopy, EventID 98)

Alerts when NTFS logs indicate a VSS (HarddiskVolumeShadowCopy) mount using EventID 98.

Windows Process Creation: Maze Ransomware Doc Dropper and Shadow Copy Deletion Indicators

Alerts on Word-to-temp execution followed by wmic shadowcopy deletion consistent with Maze-style ransomware droppers.

Windows Shadow Copy Deletion via PowerShell, WMIC, vssadmin, diskshadow, or wbadmin

Flags Windows commands that use shadow-copy management utilities with deletion or shadowstorage removal parameters.

Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands

Detects Windows processes using PowerShell/pwsh/wmic/vssadmin with shadow copy creation parameters.

Windows Volume Shadow Copy Symlink Creation Using mklink

Flags Windows mklink commands that reference HarddiskVolumeShadowCopy to create symlinks.