Esentutl Volume Shadow Copy Service Keys

 1title: Esentutl Volume Shadow Copy Service Keys
 2id: 5aad0995-46ab-41bd-a9ff-724f41114971
 3status: test
 4description: Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
 7author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
 8date: 2020-10-20
 9modified: 2022-12-25
10tags:
11    - attack.credential-access
12    - attack.t1003.002
13logsource:
14    category: registry_event
15    product: windows
16detection:
17    selection:
18        TargetObject|contains: 'System\CurrentControlSet\Services\VSS'
19        Image|endswith: 'esentutl.exe' # limit esentutl as in references, too many FP to filter
20    filter:
21        TargetObject|contains: 'System\CurrentControlSet\Services\VSS\Start'
22    condition: selection and not filter
23falsepositives:
24    - Unknown
25level: high