Credential Exfiltration via Volume Shadow Copy Service

Threat actors frequently target credential stores on Windows systems to facilitate lateral movement and privilege escalation. By utilizing the Windows Volume Shadow Copy Service (VSS), attackers can create a point-in-time snapshot of the file system. This technique allows them to read files that are typically locked by the operating system, such as the Active Directory database (NTDS.dit), the SAM registry hive, or the SECURITY hive. Once the shadow copy is mounted, attackers use standard utilities like 'copy' or 'esentutl' to extract these files to staging directories. This approach is highly effective because it operates via legitimate system APIs, often avoiding traditional file-system integrity monitoring that triggers on direct file access of locked resources.

Impact

Successful exploitation allows attackers to dump domain password hashes, local account credentials, and cached secrets. In enterprise environments, this often leads to the compromise of entire domains or significant escalation of privileges within a targeted network.

Recommendation

Detection engineering teams should monitor process creation events for any execution involving the path syntax associated with Volume Shadow Copy.

• Deploy the provided Sigma rule to detect attempts to access sensitive files via shadow copy device paths.
• Enable Sysmon Event ID 1 (Process Creation) with command line logging enabled to capture the full path and arguments used by utilities like 'copy', 'esentutl', or 'vssadmin'.
• Restrict administrative privileges to prevent unauthorized creation or mounting of shadow copies.
• Implement file integrity monitoring (FIM) on the NTDS.dit and registry hive locations to identify unusual access patterns by non-system processes.