Full Report
Attackers exploit Volume Shadow Copy for credential theft and ransomware defense evasion. See how Huntress spots the difference from routine IT activity.
Analysis Summary
# Tool/Technique: Volume Shadow Copy Service (VSS) Abuse
## Overview
Volume Shadow Copy Service (VSS) is a legitimate Microsoft Windows feature designed to create snapshots (shadow copies) of disk volumes, even while files are in use. Attackers abuse this service for two primary purposes: to inhibit system recovery by deleting backups before deploying ransomware, and to facilitate credential theft by creating snapshots to access locked system files like the Active Directory database.
## Technical Details
- **Type:** Technique (Abuse of legitimate system administration tool)
- **Platform:** Windows
- **Capabilities:** Snapshot creation, snapshot deletion, disk volume manipulation, bypassing file locks.
- **First Seen:** VSS has been a part of Windows since Server 2003; abuse by ransomware (e.g., CryptoLocker) became prominent circa 2013.
## MITRE ATT&CK Mapping
- **TA0040 - Impact**
- **T1490 - Inhibit System Recovery:** Deleting shadow copies to prevent victims from restoring encrypted data.
- **TA0006 - Credential Access**
- **T1003.002 - OS Credential Dumping: Security Account Manager:** Using VSS to shadow the SAM or NTDS.dit files.
- **T1003.003 - OS Credential Dumping: NTDS:** Extracting the Active Directory database from a shadow copy.
## Functionality
### Core Capabilities
- **Snapshot Creation:** Allows attackers to create a point-in-time copy of a volume. This enables the reading of files that are normally locked by the OS (e.g., `NTDS.dit`, `SYSTEM` hive, `SAM` hive).
- **Snapshot Deletion:** A standard pre-encryption step for ransomware to ensure local recovery options are destroyed.
- **VSSAdmin Access:** Use of the `vssadmin.exe` command-line tool to manage snapshots.
### Advanced Features
- **Stealthy Credential Extraction:** By copying the Active Directory database from a shadow copy rather than a live volume, attackers avoid triggers associated with direct memory injection or live file access.
- **Alternative Binary Execution:** Use of non-standard binaries or WMI (Windows Management Instrumentation) to manipulate VSS, bypassing simple command-line monitoring of `vssadmin.exe`.
## Indicators of Compromise
- **File Names:** `vssadmin.exe`, `ntds.dit`, `sam.save`, `system.save`
- **Behavioral Indicators:**
- Execution of `vssadmin.exe delete shadows /all /quiet`.
- WMI calls to `Win32_ShadowCopy` for deletion.
- Sudden creation of shadow copies followed by `NTDS.dit` file access/copying.
- PowerShell scripts utilizing `vss-bridge` or similar COM interfaces.
## Associated Threat Actors
- **Ransomware Groups:** Almost all major variants (LockBit, Conti, REvil, ALPHV/BlackCat).
- **APT Groups:** Various state-sponsored actors targeting Domain Controllers for long-term credential access.
## Detection Methods
- **Behavioral Detection:** Correlating VSS deletion/creation with surrounding context, such as lateral movement, suspicious process execution (e.g., `PsExec`), or mass file renaming.
- **Command-Line Monitoring:** Alerting on specific flags like `/delete`, `/shadows`, and `/quiet`.
- **WMI Event Monitoring:** Tracking the creation or deletion of snapshots via WMI providers.
## Mitigation Strategies
- **Least Privilege:** Limit the number of users with Administrative privileges who can execute VSS commands.
- **Hardening:** Implement Protected Users security groups in Active Directory to limit credential exposure.
- **Off-site Backups:** Maintain backups that are not connected to the local network (immutable backups) so that local VSS deletion does not impact recovery.
- **EDR/MDR Configuration:** Ensure security tools are tuned to look for the *sequence* of events (Shadow Copy creation -> NTDS access -> Exfiltration).
## Related Tools/Techniques
- **Diskshadow:** A legitimate Windows tool that can also be used to manage VSS and is often used as an alternative to `vssadmin`.
- **NTDSutil:** A tool used for AD database maintenance that can also trigger snapshot-like behavior.
- **Esentutl:** Often used by attackers to repair or extract data from the `NTDS.dit` file once captured.