Hayabusa medium test sigma

Diskshadow Script Mode Execution

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_img": [
    {
      "OriginalFileName": "diskshadow.exe"
    },
    {
      "Image
| endswith": "\\diskshadow.exe"
    }
  ],
  "selection_cli": {
    "CommandLine
| contains
| windash": "-s "
  },
  "condition": "process_creation and (all of selection_*)"
}

False Positives

⚠ Likely from legitimate backup scripts

Field Validations

Loading…

Comments (0)

Loading comments...