Disabled Volume Snapshots

Title: Disabled Volume Snapshots
Status: test
Description:Detects commands that temporarily turn off Volume Snapshots
References:
  -https://twitter.com/0gtweet/status/1354766164166115331
Author: Florian Roth (Nextron Systems)
Date: 2021-01-28
modified:2023-12-15
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'\Services\VSS\Diag'
      -'/d Disabled'

  condition:selection
Falsepositives:
  -Legitimate administration
Level: high