Proxy Execution via Vshadow

Status: experimental
Severity: medium
Log source: category process_creation, product windows
Author: David Faiss
Source: github.com/SigmaHQ/sigma

Detects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits. VShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag, attackers can leverage this parameter to proxy the execution of malware.

Known false positives

System backup or administrator tools
Legitimate administrative scripts

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1202` Indirect Command Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Proxy Execution via Vshadow
id: d7c75059-2901-4578-b209-8837fd31c6a8
status: experimental
description: |
    Detects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits.
    VShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag,
    attackers can leverage this parameter to proxy the execution of malware.
author: David Faiss
date: 2025-05-26
references:
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
    - https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample
tags:
    - attack.stealth
    - attack.t1202
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\vshadow.exe'
        - OriginalFileName: 'vshadow.exe'
    selection_cli:
        CommandLine|contains: '-exec'
    condition: all of selection_*
falsepositives:
    - System backup or administrator tools
    - Legitimate administrative scripts
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\vshadow.exe'
    - OriginalFileName: 'vshadow.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: '-exec'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-exec` corpus 3 (sigma 2, splunk 1)	`field:"CommandLine" kind:match value:"-exec"`
`Image`	ends_with	`\vshadow.exe`	`field:"Image" kind:ends_with value:"\vshadow.exe"`
`OriginalFileName`	eq	`vshadow.exe`	`field:"OriginalFileName" kind:eq value:"vshadow.exe"`