VolumeShadowCopy Symlink Creation Via Mklink

Title: VolumeShadowCopy Symlink Creation Via Mklink
Status: stable
Description:Shadow Copies storage symbolic link creation using operating systems utilities
References:
  -https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-10-22
modified:2023-03-06
Tags:

• -'attack.credential-access'
• -'attack.t1003.002'
• -'attack.t1003.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'mklink'
      -'HarddiskVolumeShadowCopy'

  condition:selection
Falsepositives:
  -Legitimate administrator working with shadow copies, access for backup purposes
Level: high