Detection of Shadow Copy Creation via WMIC and PowerShell

Attackers frequently utilize "Living off the Land" (LotL) techniques to conduct malicious activities without introducing custom malware. A critical component of this methodology involves the abuse of legitimate Windows utilities, specifically WMIC and PowerShell, to initiate the creation of Volume Shadow Copies. By creating these copies, attackers can bypass file system locks to access protected system files, such as the Security Account Manager (SAM) database or other sensitive configuration files. Once these files are extracted, they are often exfiltrated for offline password cracking or reconnaissance. This activity is a hallmark of credential-access phases in campaigns by various threat actors, including those attributed to Volt Typhoon, to maintain persistence or escalate privileges within a compromised environment.

Attack Chain

1. Attacker gains initial access to a Windows endpoint.
2. Attacker performs discovery to identify target sensitive files (e.g., SAM, SYSTEM, or application databases).
3. Attacker executes "wmic shadowcopy call create" or an equivalent PowerShell cmdlet to trigger a system-wide volume snapshot.
4. The operating system creates a snapshot of the requested volume, circumventing active file locks.
5. Attacker maps or copies the target files from the shadow copy volume.
6. Attacker exfiltrates the sensitive files (e.g., via C2 channel or staging server).
7. Attacker utilizes tools such as Mimikatz or Secretsdump to extract hashes or credentials from the stolen files.
8. Attacker performs offline cracking to recover cleartext credentials.

Impact

Successful exploitation allows attackers to bypass standard file system access controls, leading to widespread credential exposure. This enables lateral movement, privilege escalation, and persistent unauthorized access within the target network. The compromise of credentials facilitates long-term access, which is often difficult to detect once the attacker has established valid account control.

Recommendation

• Deploy the provided Sigma rules to detect unauthorized execution of shadow copy creation commands.
• Enable process-level logging (Sysmon Event ID 1 or Windows Security Event ID 4688) to capture command-line arguments.
• Tune the detection to exclude legitimate administrative service accounts or backup software that requires shadow copy access for legitimate system maintenance.
• Audit and restrict the use of WMIC and PowerShell by non-administrative users.