Diskshadow Script Mode - Execution From Potential Suspicious Location (fa1a7e52-3d02-435b-81b8-00da14dd66c1)
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.