Skip to content

Back to the catalog

Huntress: How Attackers Abuse VSS, and How Huntress Detects It
huntress.comarticle

Huntress: How Attackers Abuse VSS, and How Huntress Detects It

A Huntress blog post breaking down how attackers abuse Windows Volume Shadow Copy Service (VSS) beyond the well-known "delete shadow copies before ransomware detonation" pattern — including creating shadow copies to quietly extract NTDS.dit for credential access, and manipulating shadow copy size/configuration. It details why single VSS events (creation/deletion) are noisy, useless alerts on their own, and describes how Huntress correlates VSSAdmin activity with lateral movement, credential-harvesting commands, and process lineage over a time window, illustrated with a real incident involving PsExec, vssadmin create shadow against a domain controller, a blocked cleanup attempt, and follow-on DNS enumeration.

TL;DR Huntress explains how attackers abuse VSS for both anti-recovery (deleting shadow copies) and credential theft (creating shadow copies to pull NTDS.dit), and how correlation across process lineage, lateral movement, and time windows turns noisy VSSAdmin events into real detections.
Open original ↗

Organisations named here

  • NTDS.dit

Technologies named here

  • Huntress
  • VSSAdmin
  • Active Directory
  • PsExec
  • Windows
  • MITRE ATT&CK

Techniques named here

  • Inhibit System Recovery
  • Shadow copy creation for credential access
  • Shadow copy size/configuration manipulation
  • Lateral movement
  • Credential harvesting from static file copy
  • Anti-forensics / cleanup

Related in Blue Team & Detection