cscli scenarios install sigmahq/proc_creation_win_cmd_mklink_shadow_copies_access_symlink1type: trigger2name: sigmahq/proc_creation_win_cmd_mklink_shadow_copies_access_symlink3description: |4 Shadow Copies storage symbolic link creation using operating systems utilities5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains 'mklink' && evt.Parsed.CommandLine contains 'HarddiskVolumeShadowCopy')7blackhole: 2m8#status: stable9labels:10 service: windows11 confidence: 212 spoofable: 013 classification:14 - attack.t1003.00215 - attack.t1003.0031617 label: "VolumeShadowCopy Symlink Creation Via Mklink"18 behavior : "windows:audit"19 remediation: false2021scope:22 type: ParentProcessId23 expression: evt.Parsed.ParentProcessId2425