Query: write Sigma for Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives th
Matching passage: Sigma rule: Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives th. Logsource: windows / process_creation. Rule: title: Copy From VolumeShadowCopy Via Cmd.EXE id: c73124a7-3e89-44a3-bdc1-25fe4df754b1 status: test description: Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use) references: - https://twitter.com/vxunderground/status/1423336151860002816?s=20 - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2023-03-07 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'copy ' - \\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy condition: selection falsepositives: - Backup scenarios using the commandline level: high
Near-miss passage: Sigma rule: Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process inj. Logsource: windows / ps_script. Rule: title: Potential WinAPI Calls Via PowerShell Scripts id: 03d83090-8cba-44a0-b02f-0b756a050306 related: - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702 type: similar status: test description: 'Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory. ' references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse - https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1 - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community date: 2020-10-06 modified: 2026-04-29 tags: - attack.execution - attack.t1059.001 - attack.t1106 - attack.stealth - attack.t1620 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_injection: ScriptBlockText|contains|all: - VirtualAlloc - OpenProcess - WriteProcessMemory - CreateRemoteThread selection_token_steal: ScriptBlockText|contains|all: - OpenProcessToken - LookupPrivilegeValue - AdjustTokenPrivileges selection_duplicate_token: ScriptBlockText|contains|all: - OpenProcessToken - DuplicateTokenEx - CloseHandle selection_process_write_read: ScriptBlockText|contains|all: - WriteProcessMemory - VirtualAlloc - ReadProcessMemory - VirtualFree selection_local_shellcode_injection: ScriptBlockText|contains|all: - VirtualAlloc - GetDelegateForFunctionPointer - Marshal.Copy condition: 1 of selection_* falsepositives: - Unknown level: high