When Shadows Turn Hostile: How Attackers Abuse VSS (and How Huntress Catches Them)
Attackers abuse Windows VSS to delete backups for ransomware or create shadow copies to stealthily extract NTDS.dit credentials; single VSS events are noise without correlated context. VSS abuse spans three paths: deletion for ransomware recovery prevention, creation for NTDS.dit credential theft, and configuration manipulation. Individual VSS events are routine admin behavior; only correlated activity across lateral movement, credential access, and time windows distinguishes real attacks from maintenance.
Detection / Hunteropenrouter
Immediate Actions
- Monitor domain controllers for vssadmin create shadow executions
- Alert on PsExec spawning SYSTEM shells on domain controllers
- Review recent shadow copy creation events on all domain controllers
- Enable VSS service operational logging on critical servers
Key Takeaways
- VSS deletion maps to MITRE T1490 Inhibit System Recovery
- Shadow copy creation enables NTDS.dit extraction without touching the live AD database
- PsExec spawned SYSTEM-level shells on a domain controller in the described incident
- Endpoint AV blocked the post-theft shadow copy deletion attempt
- Huntress correlates VSS events with lateral movement and credential harvesting over time windows
Attack Chain
- Lateral Movement: PsExec spawns SYSTEM-level command shell on domain controller
- Discovery: Attacker enumerates active Remote Desktop sessions
- Credential Access: vssadmin create shadow to extract NTDS.dit from shadow copy
- Defense Evasion: Attempted shadow copy deletion blocked by endpoint AV
- Discovery: DNS enumeration and recon against additional host
Affected Systems
- Windows systems with Volume Shadow Copy Service
- Active Directory domain controllers
- Windows servers with NTDS.dit
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Process lineage, command lines, and VSS service events are visible via EDR telemetry. |
| Network Visibility | Medium | DNS enumeration and SMB lateral movement visible but VSS operations are host-local. |
| Detection Difficulty | Hard | VSS creation and deletion are routine; correlation across process lineage, time windows, and lateral movement is required. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Shadow copy creation followed by NTDS.dit file access within a short time window indicates credential theft via VSS (T1003.003) | VSS service log + file access events | Credential Access | Low — NTDS.dit access from shadow copy is rare |
| vssadmin delete shadows executed from non-standard parent process or after lateral movement indicates ransomware preparation (T1490) | Process creation with parent lineage correlation | Impact | Medium — backup agents also delete shadows |
| PsExec spawning SYSTEM shells on domain controllers followed by VSS operations indicates adversary credential theft (T1569.002) | SMB logs + process creation + VSS service log | Lateral Movement | Medium — legitimate admins use PsExec on DCs |
Required Log Sources
- Sysmon Event ID 1 process creation
- Windows Security Event ID 4688
- VSS service operational log
- PowerShell operational log
- SMB client/server logs
- DNS query logs
Key Behavioral Indicators
- vssadmin executed from PsExec-spawned SYSTEM shell on domain controller
- Shadow copy creation followed by NTDS.dit file access
- VSS deletion preceded by lateral movement within hours
- Multiple VSS operations from SYSTEM context on domain controllers
- vssadmin create shadow on non-backup-server hosts
- DNS enumeration commands preceding VSS operations
Control Gaps
- Signature-only AV cannot correlate VSS events with lateral movement
- Lack of process lineage correlation misses PsExec-to-vssadmin chains
- No time-window correlation between VSS and credential access
- VSS service logging not enabled by default on many Windows hosts
False Positive Assessment
High — VSS creation and deletion are routine backup and RMM operations; context correlation across process lineage, lateral movement, and time windows is required to distinguish attacks from maintenance.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict PsExec usage to specific privileged admin accounts
- Segment domain controllers to limit lateral movement paths
- Enable VSS change auditing on domain controllers and critical servers
User Protection
- Deploy EDR with process lineage correlation on domain controllers
- Ensure endpoint AV blocks unauthorized VSS deletion attempts
- Validate backup solutions are not solely dependent on local shadow copies
Security Awareness
- Document legitimate VSS maintenance schedules to baseline normal activity
- Train IT staff to report unexpected shadow copy creation or deletion alerts
MITRE ATT&CK Mapping
Execution
Credential Access
Discovery
Lateral Movement
Impact
Plain-Language Summary
Attackers are abusing a built-in Windows feature called Volume Shadow Copy in two main ways: deleting saved copies to stop victims recovering from ransomware, and creating temporary copies to silently steal login credentials from a domain controller. The problem is that creating and deleting these copies is also normal behavior for backup software and IT tools. Security teams need to look at the full picture of what happens around these actions, not just the actions themselves, to tell attacks apart from routine maintenance.
Additional IOCs
- Command Lines:
- Purpose: Create shadow copy for NTDS.dit credential theft | Tools:
vssadmin| Stage: Credential Access |vssadmin create shadow /for= - Purpose: Spawn SYSTEM-level shell on remote domain controller | Tools:
PsExec| Stage: Lateral Movement |psexec.exe \\<target> -s cmd.exe
- Purpose: Create shadow copy for NTDS.dit credential theft | Tools: