Skip to content
Threat Feed
Subscribe
medium advisory

Shadow Copies creation via native OS utilities

Adversaries may use native Windows utilities like vssadmin, wmic, or PowerShell to create shadow copies to facilitate credential access through offline extraction of the ntds.dit file.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Nov 10, 03:07 UTC
Detection
1 rule
Source quality
A1Likely

Threat actors frequently leverage built-in Windows utilities to create Volume Shadow Copies. This technique is a precursor to credential dumping, as it allows attackers to obtain copies of the Active Directory database (ntds.dit) and the SYSTEM registry hive, which are normally locked by the operating system.

Impact

Successful exploitation allows an adversary to gain offline access to the Active Directory database, leading to the potential compromise of domain-wide credentials and escalation of privileges.

Recommendation

  • Deploy the provided Sigma rule to detect the execution of utilities known for manipulating shadow copies.
  • Establish a baseline for administrative backup activities to differentiate legitimate system administration from malicious activity.
  • Restrict access to administrative tools and sensitive system files to only authorized service accounts.

Immediate actions

Deploy the provided Sigma rule to SIEM environment

Detection Engineering 48h

Threat Hunt

Identify past executions of vssadmin or wmic involving shadow copies

T1003.003 medium high confidence convert to detection

Data: Process creation logs (Event ID 1)

Detection coverage 1

Detect Shadow Copies Creation via OS Utilities

medium

Detects the execution of PowerShell, wmic, or vssadmin with command line arguments indicative of shadow copy creation

sigma tactics: credential-access techniques: T1003.002, T1003.003 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →