Credential Dumping Via Symlink To Shadow Copy

Description

This search detects the creation of a symlink to a shadow copy.