{"id":"c73124a7-3e89-44a3-bdc1-25fe4df754b1","title":"Copy From VolumeShadowCopy Via Cmd.EXE","description":"Detects the execution of the builtin \"copy\" command that targets a shadow copy (sometimes used to copy registry hives that are in use)","author":"Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)","status":"test","level":"high","date":"2021-08-09","modified":"2023-03-07","tags":["attack.impact","attack.t1490"],"technique_ids":["T1490"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Backup scenarios using the commandline"],"references":["https://twitter.com/vxunderground/status/1423336151860002816?s=20","https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection","https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"],"source_path":"rules/windows/process_creation/proc_creation_win_cmd_shadowcopy_access.yml","source_sha256":"b5ddfc56bfbb23e8bd0e130902413bb187a413b9d479d1d3eb39a73bee404d31","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmd_shadowcopy_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Copy From VolumeShadowCopy Via Cmd.EXE\nid: c73124a7-3e89-44a3-bdc1-25fe4df754b1\nstatus: test\ndescription: Detects the execution of the builtin \"copy\" command that targets a shadow copy (sometimes used to copy registry hives that are in use)\nreferences:\n    - https://twitter.com/vxunderground/status/1423336151860002816?s=20\n    - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection\n    - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/\nauthor: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)\ndate: 2021-08-09\nmodified: 2023-03-07\ntags:\n    - attack.impact\n    - attack.t1490\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        # cmd /c copy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM\\\n        # There is an additional \"\\\" to escape the special \"?\"\n        CommandLine|contains|all:\n            - 'copy '\n            - '\\\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy'\n    condition: selection\nfalsepositives:\n    - Backup scenarios using the commandline\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1490","id":"T1490","name":"Inhibit System Recovery","page":"techniques/enterprise/T1490/"}],"data_path":"data/detection-rules/c73124a7-3e89-44a3-bdc1-25fe4df754b1.json","kind":"sigma"}