Detection rules › By eventMicrosoft-Windows-Ntfs event 981 detection rule reference this event. View event page.Sigma (1)Volume Shadow Copy Mount severity low T1003.002