{"id":"f57f8d16-1f39-4dcb-a604-6c73d9b54b3d","title":"Sensitive File Access Via Volume Shadow Copy Backup","description":"Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)\n","author":"Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)","status":"test","level":"high","date":"2021-08-09","modified":"2024-01-18","tags":["attack.impact","attack.t1490"],"technique_ids":["T1490"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://twitter.com/vxunderground/status/1423336151860002816?s=20","https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection","https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_sensitive_file_access_shadowcopy.yml","source_sha256":"5d80fbff5916017984daf1182e4f3315c3aaa38a27cd10b9b0ac0fab83314dec","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_sensitive_file_access_shadowcopy.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Sensitive File Access Via Volume Shadow Copy Backup\nid: f57f8d16-1f39-4dcb-a604-6c73d9b54b3d\nstatus: test\ndescription: |\n    Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)\nreferences:\n    - https://twitter.com/vxunderground/status/1423336151860002816?s=20\n    - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection\n    - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/\nauthor: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)\ndate: 2021-08-09\nmodified: 2024-01-18\ntags:\n    - attack.impact\n    - attack.t1490\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_1:\n        # copy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\NTDS\\NTDS.dit C:\\temp\\ntds.dit 2>&1\n        # There is an additional \"\\\" to escape the special \"?\"\n        CommandLine|contains: '\\\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy'\n    selection_2:\n        CommandLine|contains:\n            - '\\\\NTDS.dit'\n            - '\\\\SYSTEM'\n            - '\\\\SECURITY'\n    condition: all of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1490","id":"T1490","name":"Inhibit System Recovery","page":"techniques/enterprise/T1490/"}],"data_path":"data/detection-rules/f57f8d16-1f39-4dcb-a604-6c73d9b54b3d.json","kind":"sigma"}