Sigma rule: Diskshadow Child Process Spawned

Rule

Title

Diskshadow Child Process Spawned

Status

test

Level

medium

Author

Harjot Singh @cyb3rjy0t

Date

2023-09-15

File

rules-threat-hunting/windows/process_creation/proc_creation_win_diskshadow_child_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications.

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith: '\diskshadow.exe'
filter_main_werfault:
    Image|endswith: ':\Windows\System32\WerFault.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Likely from legitimate usage of Diskshadow in Interpreter mode.

Tags

• attack.stealth
• attack.t1218
• attack.execution
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1218

Related rules

• fa1a7e52-3d02-435b-81b8-00da14dd66c1 (similar)
• 1dde5376-a648-492e-9e54-4241dd9b0c7f (similar)
• 9f546b25-5f12-4c8d-8532-5893dcb1e4b8 (similar)
• 0c2f8629-7129-4a8a-9897-7e0768f13ff2 (similar)

References

• https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
• https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
• https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_diskshadow_child_process.yml