Diskshadow Script Mode - Uncommon Script Extension Execution

Rule Info

Name

Diskshadow Script Mode - Uncommon Script Extension Execution

Author

Nasreddine Bencherchali (Nextron Systems)

Description

Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required.

Reference

https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/

Date

2023-09-15 00:00:00

Modified

2024-03-05 00:00:00

1dde5376-a648-492e-9e54-4241dd9b0c7f

Rule History

Author

Title

Date

Commit

github-actions[bot]

Merge PR #5149 from @nasbench - Promote older rules status from `experimental` to `test`

2025-01-06

873402272

Nasreddine Bencherchali

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12

598d29f81

frack113

Merge PR #4752 from @frack113 - Update rules to use the `windash` modifier

2024-03-11

48baf1187

Qasim Qlf

Merge PR #4718 from @qasimqlf - Update ATT&CK Mapping For Some Rules

2024-02-26

1fb3ce596

cyb3rjy0t

Merge PR #4405 from @nasbench & @cyb3rjy0t - Update Diskshadow Related Rules

2023-09-15

3b27c338f