name: Creation of Shadow Copy
id: eb120f5f-b879-4a63-97c1-93352b5df844
version: 1
date: '2019-12-10'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow
  copy.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    CommandLine: '*create*'
    Image|endswith: vssadmin.exe
  selection2:
    CommandLine: '*shadow*'
  selection3:
    CommandLine: '*shadowcopy*'
    Image|endswith: wmic.exe
  selection4:
    CommandLine: '*create*'
  condition: (selection1 and selection2) or selection3 or selection4
how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including parent-child relationships from your endpoints, to populate the Endpoint
  data model in the Processes node. The command-line arguments are mapped to the "process"
  field in the Endpoint data model.
known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will create
  false positives.
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
tags:
  analytic_story:
  - Credential Dumping
  asset_type: Endpoint
  confidence: 90
  impact: 90
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform
    offline password cracking.
  mitre_attack_id:
  - T1003.003
  - T1003
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 81
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log
    source: crowdstrike
    sourcetype: crowdstrike:events:sensor