Credential Access via Volume Shadow Copy Creation

Adversaries often attempt to bypass file system locks to access sensitive system files that are otherwise protected by the Windows operating system. By programmatically creating a Volume Shadow Copy (VSS) via PowerShell using the Win32_ShadowCopy WMI class, an attacker can create a point-in-time snapshot of the volume. This snapshot provides access to a consistent, offline copy of files such as the Active Directory database (ntds.dit) and security hive (SAM), which contain credentials. This technique is a frequent component of post-exploitation phases aimed at credential harvesting and offline cracking. Defenders must monitor PowerShell Script Block logs for the specific WMI class method calls associated with VSS creation to detect unauthorized snapshots of system volumes.

Attack Chain

1. Attacker establishes interactive shell access to a Windows host.
2. Attacker enumerates system volumes to identify the drive containing the NTDS database.
3. Attacker executes a PowerShell script to invoke the Win32_ShadowCopy WMI class.
4. Script execution triggers the Create method on the Win32_ShadowCopy class with ClientAccessible parameters.
5. The Windows VSS service generates a shadow copy of the specified volume.
6. Attacker maps the shadow copy using 'mklink' or 'vssadmin' to expose the file contents.
7. Attacker copies the sensitive ntds.dit file from the shadow copy location to a staging folder.
8. Attacker exfiltrates the database for offline credential recovery.

Impact

Successful execution of this technique allows unauthorized access to domain credentials, potentially leading to full domain compromise, lateral movement, and persistent access to the enterprise environment.

Recommendation

Deploy the provided Sigma rule to detect suspicious PowerShell script blocks invoking the Win32_ShadowCopy WMI class. Enable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to ensure visibility into the script execution. Regularly audit and limit the use of administrative PowerShell privileges to authorized service accounts and administrators.