Attackers Abuse Windows VSSAdmin to Steal Active Directory Data and Erase Recovery Copies
Threat actors are exploiting the Volume Shadow Copy Service (VSS) with VSSAdmin to exfiltrate Active Directory databases and delete recovery snapshots, hindering incident response.
Cybercriminals are weaponizing a legitimate Windows recovery feature, the Volume Shadow Copy Service (VSS), to facilitate data theft and impede restoration efforts. By abusing the VSSAdmin utility, attackers can create point-in-time copies of critical system files, including the Active Directory database (NTDS.dit), extract sensitive credentials, and then delete these shadow copies to erase forensic evidence and limit a victim's ability to recover from subsequent attacks, such as ransomware.
This technique is particularly insidious because it mimics routine administrative tasks. Legitimate backup software, remote management tools, and system administrators frequently create or remove shadow copies as part of normal operations. This overlap forces security defenders to meticulously distinguish between authorized maintenance activities and malicious intrusion attempts, making detection a significant challenge. The ultimate goal for attackers is to acquire domain credentials and simultaneously reduce the victim's recovery options, setting the stage for a more impactful attack.
Researchers at Huntress first identified this pattern while scrutinizing suspicious shadow-copy activity on a domain controller. Their investigation revealed a sequence of actions indicative of an attempt to harvest credentials, move laterally across a network, and eliminate local recovery points before the final stage of an attack. The threat actors are not solely relying on the deletion of shadow copies; they first leverage them to acquire the Active Directory data and then remove the copies to obscure their tracks and complicate rollback procedures.
The Volume Shadow Copy Service, or VSS, is designed to create consistent point-in-time snapshots of files and volumes, primarily to support backup and recovery operations. However, for a privileged attacker, VSS provides a pathway to bypass the standard file locks that protect the Active Directory database, which contains crucial account information and encrypted password material on a domain controller. This allows for the extraction of the entire database without directly interacting with the live, locked files.
In observed instances, attackers utilized tools like PsExec to establish SYSTEM-level command shells on domain controllers. From these elevated shells, they would then employ VSSAdmin to create a shadow copy. This snapshotting process enables the extraction of the directory database from a static, offline copy rather than attempting to read it directly from the live system, which can be a more conspicuous activity. A compromised directory database can then be used offline to recover password hashes and facilitate further unauthorized access across the entire domain.
The deletion of shadow copies serves a dual purpose: it removes a convenient local mechanism for restoring files and actively hinders the victim's recovery options. This tactic is often employed in conjunction with ransomware attacks, where attackers aim to narrow a victim's choices for restoration before initiating encryption. This underscores the critical point that local snapshots should never be considered the sole or primary recovery plan.
Detecting such intrusions requires a contextual approach. A VSS event in isolation is a weak indicator, as it can easily be mistaken for legitimate activity. The stronger signal emerges from the surrounding chain of events. Huntress correlated the suspicious VSS creation with other malicious activities, including SYSTEM-level remote execution, checks of active Remote Desktop sessions, credential-focused actions, DNS enumeration, and reconnaissance of other hosts. This sequence strongly suggests lateral movement rather than routine administrative tasks.
Defenders must correlate VSS creation or deletion events with unusual remote execution, suspicious account activity, directory reconnaissance, or attempts to access sensitive files. Analyzing process lineage, command history, user context, host role, and timing is crucial to determine if VSS activity is expected or part of an intrusion. The fundamental lesson is that while shadow copies aid recovery, they do not constitute a security boundary. When attackers can leverage trusted Windows utilities to create, read, and delete them, early detection hinges on recognizing the complete attack chain before stolen credentials and lost recovery options escalate an incident into a domain-wide crisis.