Uncommon creation or access operation of sensitive shadow copy

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	OS Credential Dumping (T1003)
Severity	Low

An uncommon creation or access of a sensitive Shadow Copy volume path.

Attackers may try to copy sensitive data or dump OS credentials from the host file system by using Shadow Copy volume utilities.

Verify if the shadow copy operation is part of an IT activity.
Look for other hosts performing the same shadow copy event with similar causality process behavior.
Inspect the causality process and its characteristics as they appear on other hosts.

An uncommon creation or access of a sensitive Shadow Copy volume path.

Attackers may try to copy sensitive data or dump OS credentials from the host file system by using Shadow Copy volume utilities.

Verify if the shadow copy operation is part of an IT activity.
Look for other hosts performing the same shadow copy event with similar causality process behavior.
Inspect the causality process and its characteristics as they appear on other hosts.
Investigate the remote machine, search for the stolen shadow copies and for any infection that may initiated the activity.

An uncommon creation or access of a sensitive Shadow Copy volume path by a high-risk process.

Attackers may try to copy sensitive data or dump OS credentials from the host file system by using Shadow Copy volume utilities.

Verify if the shadow copy operation is part of an IT activity.
Look for other hosts performing the same shadow copy event with similar causality process behavior.
Inspect the causality process and its characteristics as they appear on other hosts.