Symbolic Link to Shadow Copy Created

Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2021/12/25"
 3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
 4maturity = "production"
 5updated_date = "2024/10/10"
 6min_stack_version = "8.13.0"
 7min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
 8
 9[rule]
10author = ["Elastic", "Austin Songer"]
11description = """
12Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow
13copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials.
14"""
15false_positives = ["Legitimate administrative activity related to shadow copies."]
16from = "now-9m"
17index = [
18    "winlogbeat-*",
19    "logs-endpoint.events.process-*",
20    "logs-windows.forwarded*",
21    "logs-windows.sysmon_operational-*",
22    "endgame-*",
23    "logs-system.security*",
24    "logs-m365_defender.event-*",
25    "logs-sentinel_one_cloud_funnel.*",
26]
27language = "eql"
28license = "Elastic License v2"
29name = "Symbolic Link to Shadow Copy Created"
30note = """## Triage and analysis
31
32### Investigating Symbolic Link to Shadow Copy Created
33
34Shadow copies are backups or snapshots of an endpoint's files or volumes while they are in use. Adversaries may attempt to discover and create symbolic links to these shadow copies in order to copy sensitive information offline. If Active Directory (AD) is in use, often the ntds.dit file is a target as it contains password hashes, but an offline copy is needed to extract these hashes and potentially conduct lateral movement.
35
36#### Possible investigation steps
37
38- Identify the user account that performed the action and whether it should perform this kind of action.
39- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
40- Investigate other alerts associated with the user/host during the past 48 hours.
41- Determine if a volume shadow copy was recently created on this endpoint.
42- Review privileges of the end user as this requires administrative access.
43- Verify if the ntds.dit file was successfully copied and determine its copy destination.
44- Investigate for registry SYSTEM file copies made recently or saved via Reg.exe.
45- Investigate recent deletions of volume shadow copies.
46- Identify other files potentially copied from volume shadow copy paths directly.
47
48### False positive analysis
49
50- This rule should cause very few false positives. Benign true positives (B-TPs) can be added as exceptions if necessary.
51
52### Related rules
53
54- NTDS or SAM Database File Copied - 3bc6deaa-fbd4-433a-ae21-3e892f95624f
55
56### Response and remediation
57
58- Initiate the incident response process based on the outcome of the triage.
59- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
60- If the entire domain or the `krbtgt` user was compromised:
61  - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.
62- Locate and remove static files copied from volume shadow copies.
63- Command-Line tool mklink should require administrative access by default unless in developer mode.
64- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
65- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
66- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
67"""
68references = [
69    "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mklink",
70    "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf",
71    "https://blog.netwrix.com/2021/11/30/extracting-password-hashes-from-the-ntds-dit-file/",
72    "https://www.hackingarticles.in/credential-dumping-ntds-dit/",
73]
74risk_score = 47
75rule_id = "d117cbb4-7d56-41b4-b999-bdf8c25648a0"
76setup = """## Setup
77
78Ensure advanced audit policies for Windows are enabled, specifically:
79Object Access policies [Event ID 4656](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656) (Handle to an Object was Requested)

Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policies Configuration > System Audit Policies > Object Access > Audit File System (Success,Failure) Audit Handle Manipulation (Success,Failure)

 1
 2This event will only trigger if symbolic links are created from a new process spawning cmd.exe or powershell.exe with the correct arguments.
 3Direct access to a shell and calling symbolic link creation tools will not generate an event matching this rule.
 4"""
 5severity = "medium"
 6tags = [
 7    "Domain: Endpoint",
 8    "OS: Windows",
 9    "Use Case: Threat Detection",
10    "Tactic: Credential Access",
11    "Resources: Investigation Guide",
12    "Data Source: Elastic Endgame",
13    "Data Source: Elastic Defend",
14    "Data Source: System",
15    "Data Source: Microsoft Defender for Endpoint",
16    "Data Source: Sysmon",
17    "Data Source: SentinelOne",
18]
19timestamp_override = "event.ingested"
20type = "eql"
21
22query = '''
23process where host.os.type == "windows" and event.type == "start" and
24 (
25    (?process.pe.original_file_name in ("Cmd.Exe","PowerShell.EXE")) or
26    (process.name : ("cmd.exe", "powershell.exe"))
27 ) and
28
29 /* Create Symbolic Link to Shadow Copies */
30 process.args : ("*mklink*", "*SymbolicLink*") and process.command_line : ("*HarddiskVolumeShadowCopy*")
31'''
32
33
34[[rule.threat]]
35framework = "MITRE ATT&CK"
36[[rule.threat.technique]]
37id = "T1003"
38name = "OS Credential Dumping"
39reference = "https://attack.mitre.org/techniques/T1003/"
40[[rule.threat.technique.subtechnique]]
41id = "T1003.002"
42name = "Security Account Manager"
43reference = "https://attack.mitre.org/techniques/T1003/002/"
44
45[[rule.threat.technique.subtechnique]]
46id = "T1003.003"
47name = "NTDS"
48reference = "https://attack.mitre.org/techniques/T1003/003/"
49
50
51
52[rule.threat.tactic]
53id = "TA0006"
54name = "Credential Access"
55reference = "https://attack.mitre.org/tactics/TA0006/"

Triage and analysis

Shadow copies are backups or snapshots of an endpoint's files or volumes while they are in use. Adversaries may attempt to discover and create symbolic links to these shadow copies in order to copy sensitive information offline. If Active Directory (AD) is in use, often the ntds.dit file is a target as it contains password hashes, but an offline copy is needed to extract these hashes and potentially conduct lateral movement.

Possible investigation steps

  • Identify the user account that performed the action and whether it should perform this kind of action.
  • Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
  • Investigate other alerts associated with the user/host during the past 48 hours.
  • Determine if a volume shadow copy was recently created on this endpoint.
  • Review privileges of the end user as this requires administrative access.
  • Verify if the ntds.dit file was successfully copied and determine its copy destination.
  • Investigate for registry SYSTEM file copies made recently or saved via Reg.exe.
  • Investigate recent deletions of volume shadow copies.
  • Identify other files potentially copied from volume shadow copy paths directly.

False positive analysis

  • This rule should cause very few false positives. Benign true positives (B-TPs) can be added as exceptions if necessary.
  • NTDS or SAM Database File Copied - 3bc6deaa-fbd4-433a-ae21-3e892f95624f

Response and remediation

  • Initiate the incident response process based on the outcome of the triage.
  • Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
  • If the entire domain or the krbtgt user was compromised:
    • Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the krbtgt user.
  • Locate and remove static files copied from volume shadow copies.
  • Command-Line tool mklink should require administrative access by default unless in developer mode.
  • Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
  • Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
  • Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

References

Related rules

to-top