Mastodawn

Ali Hadi | B!n@ry Dec 19, 2022

I still have not found the answer to this and it would be great use to so many if there is an answer.

What is the Event ID for when a Volume Shadow Copy gets deleted? I know #Sysmon can show you this, but is there anything else? #DFIR #DigitalForensics #SOC #SIEM #BlueTeam #malware

Show thread

Doug Metz Dec 19, 2022

@dfir best I’ve been able to find so far is tied to 4868. https://car.mitre.org/analytics/CAR-2021-01-009/. Labworthy.

CAR-2021-01-009: Detecting Shadow Copy Deletion or Resize

Cyber Analytics Repository

MITRE Cyber Analytics Repository

Show thread

Ali Hadi | B!n@ry

@dwmetz Yes, I've checked these before and there is currently no such event; haven't been able to see it. The #Sysmon one does exist, but I want to see what else is there, because what if we don't have Sysmon on the endpoint! Thanks Doug!