Hayabusa informational test sigma

VSSAudit Security Event Source Registration

Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "AuditSourceName": "VSSAudit",
    "EventID": [
      4904,
      4905
    ]
  },
  "condition": "security and selection"
}

False Positives

⚠ Legitimate use of VSSVC. Maybe backup operations. It would usually be done by C:\Windows\System32\VSSVC.exe.

Field Validations

Loading…

Comments (0)

Loading comments...