Accessing Volume Shadow Copies
Tags
attack-pattern: Data Tool - T1588.002
Common Information
Type Value
UUID 1ed96dde-ae92-4b4e-b655-2665914f1504
Fingerprint 1c0ddc503c6d8d95
Analysis status DONE
Considered CTI value 0
Text language
Published Jan. 4, 2011, 5:23 a.m.
Added to db Jan. 19, 2023, 12:06 a.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline Windows Incident Response
Title Accessing Volume Shadow Copies
Detected Hints/Tags/Attributes 32/1/5
Attributes
Details Type #Events CTI Value
Details File 10
dd.exe
Details File 1
001.vmdk
Details File 3
vhdtool.exe
Details File 6
rip.exe
Details File 30
ftp.exe