
(CAPA) CAPA_resize_volume_shadow_copy_storage
Created the . Updated 9 months, 1 week ago.
rule:
meta:
name: resize volume shadow copy storage
namespace: impact/inhibit-system-recovery
author: michael.hunhoff@mandiant.com
scope: basic block
features:
- and:
- api: kernel32.DeviceIoControl
- number: 0x53C028 = IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE
Associated Techniques
No associated technique found so far.