Attackers are increasingly misusing a native Windows feature—Volume Shadow Copy Service (VSS)—to steal Active Directory credentials (via the NTDS.dit database) and delete recovery snapshots, leaving organizations fewer options to restore systems after ransomware strikes.
How the Attack Works
In a pattern detailed by Huntress researchers, adversaries start with SYSTEM-level remote execution on a domain controller, often using tools like PsExec. Once inside, they create a shadow copy via VSSAdmin. Because the Active Directory database is locked when the system is running, creating a snapshot lets attackers access NTDS.dit from that frozen copy instead of forcing access to the live file.
After extracting credential hashes and gathering reconnaissance—such as checking Remote Desktop sessions or enumeration of hosts—attackers delete the shadow copies. That removal step diminishes both evidence of malicious activity and local recovery options that organizations could use to roll back changes before damage compounds.
Detection & Defence Challenges
On its own, a VSS shadow-copy creation or deletion event often appears benign. Routine backups, monitoring tools, or legitimate admin tasks trigger similar activity, making isolated alerts hit-and-miss. What reveals an intrusion is the broader context—credential abuse, use of tools like PsExec, domain reconnaissance, lateral movement, etc.—all clustered around the VSS actions.
To better discriminate malicious behavior, defenders are advised to track event chains rather than single actions. Important signals include SYSTEM-context command shells, unexpected remote tool usage, sensitive file access, and directories or hosts being probed. Correlating time, user identity, process lineage, and host role also helps build a more accurate picture of threats.
Mitigation Steps
Organizations should bolster their recovery strategies by storing backups offline or offsite, away from direct access paths that attackers can reach. Regular restoration tests help ensure the backups actually work when needed. Limiting privileged access—particularly to domain controllers—and monitoring for suspicious remote execution or credential harvesting activities are essential.
Alerts should be configured to catch VSSAdmin commands like “vssadmin create shadow” or shadow removal—but only trigger high severity when they occur alongside other elevated-risk actions. That reduces noise while ensuring real threats are flagged.
Why this matters: Windows’ VSS is a powerful tool for legitimate backups—but when attackers use it to clone NTDS.dit and then erase their tracks, organizations see credential theft and severely reduced recovery options. The real danger comes not just from the data leak, but from how attackers tie together legitimate tools, permissions, and deletion actions to turn VSS into a multi-stage attack.
Analytical Takeaway
This abuse of VSSAdmin isn’t a novel technique—but it underscores a shift: threat actors are chaining everyday admin tools and system utilities into multi-step attacks that span credential theft, lateral movement, and sabotage of recovery infrastructure. As detection strategies evolve, it’s going to be critical for defenders to connect dots across what were once siloed security events. If snapshots and backups are a key safety net, attackers are now treating them as targets—and defenders must do the same.
