Diskshadow Child Process Spawned

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Harjot Singh @cyb3rjy0t
Source: github.com/SigmaHQ/sigma

Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications.

Known false positives

Likely from legitimate usage of Diskshadow in Interpreter mode.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Diskshadow Child Process Spawned
id: 56b1dde8-b274-435f-a73a-fb75eb81262a
related:
    - id: fa1a7e52-3d02-435b-81b8-00da14dd66c1 # Diskshadow Script Mode - Execution From Potential Suspicious Location
      type: similar
    - id: 1dde5376-a648-492e-9e54-4241dd9b0c7f # Diskshadow Script Mode - Uncommon Script Extension Execution
      type: similar
    - id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8 # Potentially Suspicious Child Process Of DiskShadow.EXE
      type: similar
    - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2 # Diskshadow Script Mode Execution
      type: similar
status: test
description: Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications.
references:
    - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
    - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow
author: Harjot Singh @cyb3rjy0t
date: 2023-09-15
tags:
    - attack.stealth
    - attack.t1218
    - attack.execution
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\diskshadow.exe'
    filter_main_werfault:
        Image|endswith: ':\Windows\System32\WerFault.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Likely from legitimate usage of Diskshadow in Interpreter mode.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    ParentImage|endswith: '\diskshadow.exe'

Stage 2: `not filter_main_werfault`

filter_main_werfault:
    Image|endswith: ':\Windows\System32\WerFault.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`:\Windows\System32\WerFault.exe`	`excludes:Image` `field:"Image" value:":\Windows\System32\WerFault.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ParentImage`	ends_with	`\diskshadow.exe` corpus 2 (sigma 2)	`field:"ParentImage" kind:ends_with value:"\diskshadow.exe"`