Detection rules › Sigma

Diskshadow command abuse to expose VSS backup

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attemps to create an IFM for dumping credentials.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003 OS Credential Dumping

Event coverage

Rule body yaml

title: Diskshadow command abuse to expose VSS backup
description: Detects scenarios where an attacker attemps to create an IFM for dumping credentials.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://blog.menasec.net/2019/11/forensics-traces-of-ntdsdit-dumping.html
- https://adsecurity.org/?p=2398
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
tags:
- attack.credential_dumping
- attack.t1003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection: # Full command: "diskshadow.exe /s shadow.txt"
    EventID: 4688
    NewProcessName|endswith: \diskshadow.exe
    CommandLine|contains: diskshadow
    CommandLine|contains:
      - /s
      - -s
  condition: selection
falsepositives:
- Administrator manipulating VSS backup
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 4688
  NewProcessName|endswith: \diskshadow.exe
  CommandLine|contains: diskshadow
  CommandLine|contains:
    - /s
    - -s

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -s corpus 10 (sigma 4, kusto 4, elastic 1, splunk 1)
  • /s corpus 8 (sigma 6, splunk 2)
NewProcessNameends_with
  • \diskshadow.exe corpus 5 (sigma 5)