Title:
Proxy Execution via Vshadow
Status:
experimental
Description:Detects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits.
VShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag,
attackers can leverage this parameter to proxy the execution of malware.
References:
-https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
-https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample
Author: David Faiss
Date: 2025-05-26
modified:None
Tags:
- -'attack.stealth'
- -'attack.t1202'
Logsource:
- product: windows
- category: process_creation
Detection:
selection_img:
Image|endswith:
'\vshadow.exe'
OriginalFileName:
'vshadow.exe'
selection_cli:
CommandLine|contains:
'-exec'
condition:
all of selection_*
Falsepositives:
-System backup or administrator tools
-Legitimate administrative scripts
Level:
medium
