Techniques
Sample rules
Symbolic Link to Shadow Copy Created
- source: elastic
- technicques:
- T1003
Description
Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials.
Detection logic
process where host.os.type == "windows" and event.type == "start" and
(
(?process.pe.original_file_name in ("Cmd.Exe","PowerShell.EXE")) or
(process.name : ("cmd.exe", "powershell.exe"))
) and
/* Create Symbolic Link to Shadow Copies */
process.args : ("*mklink*", "*SymbolicLink*") and process.command_line : ("*HarddiskVolumeShadowCopy*")