Esentutl Volume Shadow Copy Service Keys

calendar Dec 27, 2022 · attack.credential_access attack.t1003.002  ·
Share on: linkedin copy

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\System\CurrentControlSet\Services\VSS\Diag\VolSnap\Volume are captured.

Sigma rule (View on GitHub)

 1title: Esentutl Volume Shadow Copy Service Keys
 2id: 5aad0995-46ab-41bd-a9ff-724f41114971
 3status: test
 4description: Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
 7author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
 8date: 2020/10/20
 9modified: 2022/12/25
10tags:
11    - attack.credential_access
12    - attack.t1003.002
13logsource:
14    category: registry_event
15    product: windows
16detection:
17    selection:
18        TargetObject|contains: 'System\CurrentControlSet\Services\VSS'
19        Image|endswith: 'esentutl.exe' # limit esentutl as in references, too many FP to filter
20    filter:
21        TargetObject|contains: 'System\CurrentControlSet\Services\VSS\Start'
22    condition: selection and not filter
23falsepositives:
24    - Unknown
25level: high

References

Related rules

to-top