Skip to content
Threat Feed
Subscribe

Tag

Forensics

1 brief RSS
high advisory

Detection of Registry Hive Exfiltration via Volume Shadow Copy

Adversaries use the Windows 'copy' command to exfiltrate sensitive files, such as registry hives, by accessing data from Volume Shadow Copy Service snapshots.

credential-theft persistence windows forensics
1r 1t