Skip to content

Hide Navigation Hide TOC

Diskshadow Script Mode - Execution From Potential Suspicious Location (fa1a7e52-3d02-435b-81b8-00da14dd66c1)

Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

Cluster A Galaxy A Cluster B Galaxy B Level
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern Diskshadow Script Mode - Execution From Potential Suspicious Location (fa1a7e52-3d02-435b-81b8-00da14dd66c1) Sigma-Rules 1