Sunturai
Back to results
MediumSplunk security contentRaven Tait +1

Windows VSSVC Process Accessing Defender Engine

Detects vssvc.exe opening a handle to MsMpEng.exe. In the RedSun exploit, VSS participates in the cloud-file restore race that directs WD to write through the NTFS junction. This handle acquisition is observed at the…

Description

Detects vssvc.exe opening a handle to MsMpEng.exe. In the RedSun exploit, VSS participates in the cloud-file restore race that directs WD to write through the NTFS junction. This handle acquisition is observed at the exact moment of exploitation. vssvc querying MsMpEng is not expected in normal operation.

Detection logic

Detection requirements

Platform
ContainersLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
sysmon_eventid_10

Known benign triggers

  • No false positives have been identified at this time.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice