Shadow Copy Created (Windows Event Log)

id: '6148.6668'
title: Shadow Copy Created
description: 'Shadow Copy (also known as Volume Snapshot Service, Volume Shadow Copy
  Service or VSS) is a technology included in Microsoft Windows that can create backup
  copies or snapshots of computer files or volumes, even when they are in use. Adversaries
  have used this service to create copies of locked files such as ntds.dit. -- Threat
  Actor Association: Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Volt Typhoon -- Software Association: PYSA/Mespinoza
  -- Atomics T1003.003Test #1 Atomics T1003.003 Test #3 Atomics T1003.003 Test #4
  Atomics T1003.003 Test #5 Atomics T1003.003 Test #6 Atomics T1003.003 Test #7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=8222) OR
  "<EventID>8222<") "Shadow copy has been created" | rex field=_raw (?<ioc>"(?i)Shadow
  copy has been created")| eval user=User_name, process_name=Process_image_name |
  table _time, host, user, signature_id, signature, process, process_*, parent_*,
  ioc | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- Windows event logs
references:
- https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/