Sigma medium test sigma

Diskshadow Script Mode Execution

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.

View Source

Detection Logic

{
  "selection_img": [
    {
      "OriginalFileName": "diskshadow.exe"
    },
    {
      "Image
| endswith": "\\diskshadow.exe"
    }
  ],
  "selection_cli": {
    "CommandLine
| contains
| windash": "-s "
  },
  "condition": "all of selection_*"
}

False Positives

  • ⚠ Likely from legitimate backup scripts

Field Validations

Loading…

Comments (0)

Loading comments...