Detection of Registry Hive Exfiltration via Volume Shadow Copy

Threat actors frequently target the Windows registry hives (SAM, SYSTEM, SECURITY) to extract password hashes for offline cracking or lateral movement. Because these files are locked by the operating system during active sessions, attackers utilize the Volume Shadow Copy Service (VSS) to create snapshots of the disk. By mounting these snapshots using the \?\GLOBALROOT device path, attackers can bypass file locks to copy protected files. This technique is commonly observed in post-exploitation phases where attackers aim to escalate privileges or move laterally through the environment. Defending against this requires monitoring for direct command-line access to VSS device paths via common file utilities.

Attack Chain

1. Attacker gains administrative access to the target endpoint.
2. Attacker executes vssadmin or similar tools to create a new volume shadow copy.
3. Attacker identifies the device path of the newly created shadow copy (e.g., \?\GLOBALROOT\Device\HarddiskVolumeShadowCopyX).
4. Attacker constructs a copy command targeting the sensitive file path within the shadow copy device mount.
5. Attacker executes 'cmd.exe /c copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopyX\Windows\System32\config\SYSTEM C:\Temp\SYSTEM'.
6. The OS allows the copy operation because the file is read from a snapshot rather than the live locked registry hive.
7. Attacker exfiltrates the copied hive files to an external C2 or staging area for local analysis.

Impact

Successful execution of this technique allows attackers to obtain critical credentials (e.g., NTLM hashes or Kerberos keys) stored in the registry. This often leads to full domain compromise, as the attacker can perform pass-the-hash attacks or use the stolen credentials to impersonate high-privilege service accounts.

Recommendation

Deploy the provided Sigma rule to detect the specific use of the 'copy' command against VSS device paths. Configure EDR or Sysmon to log all command-line arguments (Event ID 1). Audit usage of administrative tools like vssadmin to detect the creation of snapshots prior to the file copy operation.