{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/forensics/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["credential-theft","persistence","windows","forensics"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThreat actors frequently target the Windows registry hives (SAM, SYSTEM, SECURITY) to extract password hashes for offline cracking or lateral movement. Because these files are locked by the operating system during active sessions, attackers utilize the Volume Shadow Copy Service (VSS) to create snapshots of the disk. By mounting these snapshots using the \\?\\GLOBALROOT device path, attackers can bypass file locks to copy protected files. This technique is commonly observed in post-exploitation phases where attackers aim to escalate privileges or move laterally through the environment. Defending against this requires monitoring for direct command-line access to VSS device paths via common file utilities.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains administrative access to the target endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker executes vssadmin or similar tools to create a new volume shadow copy.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the device path of the newly created shadow copy (e.g., \\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopyX).\u003c/li\u003e\n\u003cli\u003eAttacker constructs a copy command targeting the sensitive file path within the shadow copy device mount.\u003c/li\u003e\n\u003cli\u003eAttacker executes 'cmd.exe /c copy \\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopyX\\Windows\\System32\\config\\SYSTEM C:\\Temp\\SYSTEM'.\u003c/li\u003e\n\u003cli\u003eThe OS allows the copy operation because the file is read from a snapshot rather than the live locked registry hive.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates the copied hive files to an external C2 or staging area for local analysis.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful execution of this technique allows attackers to obtain critical credentials (e.g., NTLM hashes or Kerberos keys) stored in the registry. This often leads to full domain compromise, as the attacker can perform pass-the-hash attacks or use the stolen credentials to impersonate high-privilege service accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDeploy the provided Sigma rule to detect the specific use of the 'copy' command against VSS device paths. Configure EDR or Sysmon to log all command-line arguments (Event ID 1). Audit usage of administrative tools like vssadmin to detect the creation of snapshots prior to the file copy operation.\u003c/p\u003e\n","date_modified":"2026-09-03T12:37:20Z","date_published":"2026-09-03T12:37:20Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cmd-shadowcopy-access/","summary":"Adversaries use the Windows 'copy' command to exfiltrate sensitive files, such as registry hives, by accessing data from Volume Shadow Copy Service snapshots.","title":"Detection of Registry Hive Exfiltration via Volume Shadow Copy","url":"https://feed.craftedsignal.io/briefs/2026-09-cmd-shadowcopy-access/"}],"language":"en","title":"CraftedSignal Threat Feed - Forensics","version":"https://jsonfeed.org/version/1.1"}