Sigma rule: Proxy Execution via Vshadow

Rule

Title

Proxy Execution via Vshadow

Status

experimental

Level

medium

Author

David Faiss

Date

2025-05-26

File

rules/windows/process_creation/proc_creation_win_vshadow_exec.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits.
VShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag,
attackers can leverage this parameter to proxy the execution of malware.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\vshadow.exe'
    - OriginalFileName: 'vshadow.exe'
selection_cli:
    CommandLine|contains: '-exec'
condition: all of selection_*

False positives (as the rule lists them)

• System backup or administrator tools
• Legitimate administrative scripts

Tags

• attack.stealth
• attack.t1202

MITRE ATT&CK ids this rule names

• T1202

References

• https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
• https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_vshadow_exec.yml