Detection rules › Splunk
Shadow Copy Created (Windows Event Log)
Shadow Copy (also known as Volume Snapshot Service, Volume Shadow Copy Service or VSS) is a technology included in Microsoft Windows that can create backup copies or snapshots of computer files or volumes, even when they are in use. Adversaries have used this service to create copies of locked files such as ntds.dit
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1003.003 OS Credential Dumping: NTDS |
References
Event coverage
| Provider | Event |
|---|---|
| VSSAudit | Event ID 8222 |
Rule body yaml
id: '6148.6668'
title: Shadow Copy Created
description: 'Shadow Copy (also known as Volume Snapshot Service, Volume Shadow Copy
Service or VSS) is a technology included in Microsoft Windows that can create backup
copies or snapshots of computer files or volumes, even when they are in use. Adversaries
have used this service to create copies of locked files such as ntds.dit. -- Threat
Actor Association: Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
PRESIDENT/TA416/RedDelta), Volt Typhoon -- Software Association: PYSA/Mespinoza
-- Atomics T1003.003Test #1 Atomics T1003.003 Test #3 Atomics T1003.003 Test #4
Atomics T1003.003 Test #5 Atomics T1003.003 Test #6 Atomics T1003.003 Test #7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=8222) OR
"<EventID>8222<") "Shadow copy has been created" | rex field=_raw (?<ioc>"(?i)Shadow
copy has been created")| eval user=User_name, process_name=Process_image_name |
table _time, host, user, signature_id, signature, process, process_*, parent_*,
ioc | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- Windows event logs
references:
- https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=8222) OR "<EventID>8222<") "Shadow copy has been created"
Stage 2: rex
| rex field=_raw (?<ioc>"(?i)Shadow copy has been created")
Stage 3: eval
| eval user=User_name, process_name=Process_image_name
Stage 4: table
| table _time, host, user, signature_id, signature, process, process_*, parent_*, ioc
Stage 5: bucket
| bin span=1s
Stage 6: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>8222<" |
| 1 | "Shadow copy has been created" |