Detection rules › Sigma

Esentutl Volume Shadow Copy Service Keys

Severity
high
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source
upstream

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\System\CurrentControlSet\Services\VSS\Diag\VolSnap\Volume are captured.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.002 OS Credential Dumping: Security Account Manager

Event coverage

ProviderEvent IDTitle
Sysmon12RegistryEvent (Object create and delete)
Sysmon13RegistryEvent (Value Set)
Sysmon14RegistryEvent (Key and Value Rename)

Stages and Predicates

Stage 1: selection

Image|endswith: esentutl.exe
TargetObject|contains: 'System\CurrentControlSet\Services\VSS'

Stage 2: not filter

TargetObject|contains: 'System\CurrentControlSet\Services\VSS\Start'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • esentutl.exe
TargetObjectmatch
  • System\CurrentControlSet\Services\VSS
  • System\CurrentControlSet\Services\VSS\Start