Detection of Shadow Copy Creation via System Utilities

Threat actors commonly leverage built-in Windows utilities to interact with the Volume Shadow Copy Service (VSS) for malicious purposes. While VSS is a legitimate administrative feature for backups, attackers use it to create snapshots of the operating system volume. Once a shadow copy is created, the attacker can extract the NTDS.dit file, which contains the Active Directory database and hashed credentials for domain users. By using trusted system binaries (Living off the Land), attackers attempt to bypass detection mechanisms that focus on non-standard tools or malware. This technique is often seen in the post-exploitation phase of a compromise to facilitate lateral movement or privilege escalation. Defensive visibility into the command-line arguments used during VSS operations is critical for identifying unauthorized credential access attempts.

Impact

Successful exploitation of this technique leads to the acquisition of the NTDS.dit file, enabling attackers to perform offline cracking of domain credentials. This significantly increases the risk of full domain compromise, unauthorized access to sensitive data, and potential persistence in the environment. Targeted sectors include any organization relying on Active Directory, making this a common TTP across various ransomware and espionage campaigns.

Recommendation

Detection engineering teams should monitor for the execution of VSS-related commands by non-administrative users or processes.

• Implement the provided Sigma rule to alert on suspicious command-line patterns involving vssadmin, wmic, or PowerShell.
• Establish a baseline for legitimate backup administrative activity to reduce noise from backup software or maintenance tasks.
• Ensure Sysmon or equivalent EDR process creation logging is active to capture Image, OriginalFileName, and CommandLine fields.
• Restrict access to administrative tools and sensitive system files to only authorized service accounts.