Question Analysis

DeviceProcessEvents | where FileName =~ "vssadmin.exe" | where ProcessCommandLine has "list shadows" | project Timestamp, DeviceName, ProcessCommandLine

DeviceProcessEvents | where FileName == 'vssadmin.exe' and ProcessCommandLine contains 'list shadows' | project TimeGenerated, DeviceName, ProcessCommandLine

DeviceProcessEvents | where FileName =~ "vssadmin.exe" | where ProcessCommandLine has_any ("list shadows", "list shadowstorage") | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine

DeviceProcessEvents | where FileName =~ "vssadmin.exe" and (ProcessCommandLine contains "list" and ProcessCommandLine contains "shad")

DeviceProcessEvents | where ProcessCommandLine has_any ('vssadmin', 'vssadmin list shadows', 'shadowcopy', 'shadow copy') | where ProcessCommandLine contains 'list shadows' or ProcessCommandLine contains 'list shadows' | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, InitiatingProcessFileName

DeviceProcessEvents | where FileName == "vssadmin.exe" and ProcessCommandLine contains "list shadows" | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine

// Shadow Copy enumeration: vssadmin list shadows (and wmic shadowcopy list) let vss_list = DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "vssadmin.exe" | where ProcessCommandLine matches regex @"(?i)\blist\s+shadows?\b"; // enumerate existing snapshots let wmic_list = DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "wmic.exe" | where ProcessCommandLine matches regex @"(?i)\bwmic(\.exe)?\s+shadowcopy\s+list\b"; // alternate enumeration union vss_list, wmic_list | project TimeGenerated, DeviceId, DeviceName, AccountDomain, AccountName, FileName, FolderPath, ProcessCommandLine | extend FullCommand = coalesce(ProcessCommandLine, strcat(FolderPath, "\\", FileName)) | order by TimeGenerated desc

union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents | extend CommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) | where isnotempty(CommandLine) | where ( (tolower(CommandLine) contains "vssadmin" and (tolower(CommandLine) contains "list" or tolower(CommandLine) contains "shadows" or tolower(CommandLine) contains "shadowstorage")) or tolower(CommandLine) contains "wmic shadowcopy" or ((tolower(CommandLine) contains "get-wmiobject" or tolower(CommandLine) contains "get-ciminstance" or tolower(CommandLine) contains "gwmi") and tolower(CommandLine) contains "shadow") ) | project TimeGenerated, DeviceName, AccountName = coalesce(InitiatingProcessAccountName, AccountName), UserPrincipal = coalesce(InitiatingProcessAccountUpn, AccountUpn), ProcessId = coalesce(ProcessId, InitiatingProcessId), FileName = coalesce(FileName, InitiatingProcessFileName), CommandLine, ReportId, TenantId | sort by TimeGenerated desc

union DeviceProcessEvents, DeviceEvents, DeviceFileEvents, DeviceImageLoadEvents | where FileName has_any ("vssadmin.exe", "diskshadow.exe", "wmic.exe") or ProcessCommandLine has_any ("vssadmin", "diskshadow", "list shadows", "list shadow", "shadowcopy", "shadowcopies", "wmic shadowcopy", "shadow copy") or InitiatingProcessCommandLine has_any ("vssadmin", "diskshadow", "list shadows", "list shadow", "shadowcopy", "shadowcopies", "wmic shadowcopy", "shadow copy") | extend EventTime = coalesce(TimeGenerated, Timestamp) | extend FullCommand = coalesce(ProcessCommandLine, InitiatingProcessCommandLine) // Keep records that are likely to be enumerating snapshots | where FullCommand has_any ("list shadows", "shadowcopy", "shadowcopies") or FileName has_any ("vssadmin.exe", "diskshadow.exe") | project EventTime, DeviceName, Account = coalesce(InitiatingProcessAccountName, AccountName), FileName, ProcessId = coalesce(ProcessId, InitiatingProcessId), InitiatingProcessFileName, FullCommand, ReportId | sort by EventTime desc

// Detect usage of vssadmin to enumerate shadows let lookback = 30d; // actual time range will be set by caller/timepicker let p1 = DeviceProcessEvents | where TimeGenerated >= ago(lookback) | where tolower(InitiatingProcessFileName) has "vssadmin" or tolower(ProcessCommandLine) has "vssadmin" | where tolower(InitiatingProcessCommandLine) has "list" or tolower(InitiatingProcessCommandLine) has "shadows" or tolower(ProcessCommandLine) has "list" or tolower(ProcessCommandLine) has "shadows" | extend FullCommand = coalesce(InitiatingProcessCommandLine, ProcessCommandLine) | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessFileName, FullCommand, ReportId, TenantId, SourceSystem, _ResourceId; let p2 = DeviceEvents | where TimeGenerated >= ago(lookback) | where tolower(FileName) has "vssadmin" or tolower(ProcessCommandLine) has "vssadmin" or tolower(InitiatingProcessFileName) has "vssadmin" | extend FullCommand = coalesce(ProcessCommandLine, InitiatingProcessCommandLine, AdditionalFields.CommandLine, tostring(AdditionalFields.CommandLine)) | where tolower(FullCommand) has "list" or tolower(FullCommand) has "shadows" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessId = coalesce(InitiatingProcessId, ProcessId), InitiatingProcessFileName = coalesce(InitiatingProcessFileName, FileName), FullCommand, ReportId, TenantId, SourceSystem, _ResourceId; union p1, p2 | sort by TimeGenerated desc | distinct TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessFileName, FullCommand, ReportId, TenantId, SourceSystem, _ResourceId | where isnotempty(FullCommand) | extend CommandLower = tolower(FullCommand) | where CommandLower has "vssadmin" and (CommandLower has "list" or CommandLower has "shadows" or CommandLower has "shadow") | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessFileName, FullCommand | take 100

DeviceProcessEvents | where InitiatingProcessFileName contains "vssadmin" or tolower(InitiatingProcessCommandLine) contains "vssadmin" | where tolower(InitiatingProcessCommandLine) contains "list shadows" | extend FullCommand = InitiatingProcessCommandLine | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, FullCommand | sort by TimeGenerated desc

let timeWindow = 1d; DeviceProcessEvents | where TimeGenerated >= ago(timeWindow) | where InitiatingProcessCommandLine has_cs "vssadmin" and InitiatingProcessCommandLine has_cs "list" and InitiatingProcessCommandLine has_cs "shadows" | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine

DeviceProcessEvents | where FileName == 'vssadmin.exe' and ProcessCommandLine contains 'list shadows' | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName | order by Timestamp desc

DeviceProcessEvents | where FileName == "vssadmin.exe" | where tolower(ProcessCommandLine) contains "list shadows" | project Timestamp, DeviceName, AccountName, ProcessCommandLine | order by Timestamp desc

DeviceProcessEvents | where tolower(FileName) == "vssadmin.exe" or tolower(InitiatingProcessFileName) == "vssadmin.exe" | where tolower(ProcessCommandLine) has "list shadows" or tolower(InitiatingProcessCommandLine) has "list shadows" | extend fullCommand = iif(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine) | project TimeGenerated, DeviceName, fullCommand | order by TimeGenerated desc

DeviceProcessEvents | where (InitiatingProcessFileName =~ "vssadmin.exe" or FileName =~ "vssadmin.exe") | where tolower(iif(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine)) contains "list shadows" | project TimeGenerated, DeviceName, FullCommand = iif(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine) | order by TimeGenerated desc

let ShadowTools = dynamic(["vssadmin.exe","diskshadow.exe","wmic.exe"]); DeviceProcessEvents | where FileName in~ (ShadowTools) | where ProcessCommandLine matches regex @"(?i)\b(list|get|enum)\b.*\b(shadow|shadowcopy)s?\b" | project TimeGenerated, DeviceName, User = InitiatingProcessAccountName, Executable = FileName, CommandLine = ProcessCommandLine | sort by TimeGenerated desc

DeviceProcessEvents // Filter for built-in Shadow Copy utilities | where FileName in ("vssadmin.exe", "diskshadow.exe") // Look for commands that enumerate snapshots | where tolower(ProcessCommandLine) has "list shadows" // Project the relevant details | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine | sort by TimeGenerated desc