Correlating VSS Activity Helps Detect Ransomware and Credential Theft
Summary
Attackers can delete shadow copies to hinder recovery or create them to extract credentials. Because legitimate tools also use VSS, detections should correlate its activity with process behavior, lateral movement, and credential-harvesting signals.
Key points
- Attackers may delete shadow copies to obstruct recovery or create them to extract the Active Directory database file NTDS.dit.
- VSS creation and deletion are also routine for backup and remote-management tools, so either event alone is a weak alert signal.
- The article recommends assessing how VSS activity occurred and correlating it with other events over time.
- In the described intrusion, PsExec launched SYSTEM-level shells on a domain controller before VSS creation, credential-access activity, an attempted shadow-copy deletion, and reconnaissance on another host.
- The attempted deletion was blocked and flagged by endpoint antivirus.
- The sequence’s combination of credential-access attempts and lateral movement made the VSS activity more suspicious than any individual event.
Article Details
- Defense Focus
- Distinguish malicious Volume Shadow Copy Service activity from routine backup and administration by correlating shadow-copy events with surrounding process activity, lateral movement, and credential-harvesting behavior.
- Detection Methods
- Assess how shadow copies were deleted, accounting for VSSAdmin and other services or binaries that can perform deletion.
- Treat shadow-copy creation as suspicious when paired with signs of lateral movement and credential harvesting before or after the event.
- Correlate events over a time window, including process lineage and tooling, rather than alerting on creation or deletion alone.
- Investigate sequences such as PsExec spawning SYSTEM-level shells, Remote Desktop session enumeration, shadow-copy creation, credential-access activity, subsequent deletion attempts, and reconnaissance on other hosts.
- Data Sources
- Endpoint volume shadow-copy activity
- Process creation and process lineage
- Command-line activity
- Endpoint antivirus detections and blocked actions
- Remote Desktop session enumeration
- DNS enumeration and host reconnaissance events
- Rule Types
- Correlated behavioral detections over a time window; no specific query or rule language is identified.
- Platforms
- Windows endpoints
- Domain controllers
- Defensive Actions
- Do not treat shadow-copy creation or deletion alone as an incident; review the surrounding activity and operational context.
- Investigate shadow-copy creation when it coincides with lateral movement or credential-harvesting commands.
- Review the process lineage and tools involved, including the method used to delete shadow copies.
- Correlate activity across hosts and time, and assess whether subsequent deletion attempts were blocked or flagged by endpoint antivirus.
- Use human review alongside event correlation to distinguish routine administrative cleanup from attack activity.
MITRE ATT&CK
T1003.003 · NTDSThe described attacker created a shadow copy and used it to access the NTDS.dit Active Directory database for credential theft.T1018 · Remote System DiscoveryThe described activity included reconnaissance against at least one additional host as evidence of lateral movement.T1021.001 · Remote Desktop ProtocolThe sequence included enumeration of active Remote Desktop sessions, but the article does not establish that RDP was used for access.T1078 · Valid AccountsPsExec was used to spawn SYSTEM-level command shell processes on a domain controller; the article does not specify which account type was used.T1490 · Inhibit System RecoveryThe article identifies shadow-copy deletion to prevent recovery as an example of Inhibit System Recovery.
People
Vendors
Products
Microsoft 365Our platform combines a suite of powerful managed detection and response tools for endpoints and Microsoft 365 identities, science-backed security awareness training, and the expertise of our 24/7 Security OperationsMicrosoft Windowsthe hood, and where it starts to buckle: the 64TB volume ceiling, the Copy-on-Write performance tax, the Windows lock-in, and the hard truth that a snapshot is not a recovery plan.Volume Shadow Copy Service (VSS)In our last post, we walked through what Microsoft's Volume Shadow Copy Service (VSS) actually does under the hood, and where it starts to buckle: the 64TB volume ceiling, the Copy-on-Write performance tax, the Windows
Tools
PsExecLaid out in order, the sequence reads like this: PsExec was used to spawn SYSTEM-level command shell processes on a domain controller. From there, the attacker enumerated active Remote Desktop sessions, then ranvssadminHuntress ransomware detections look at how the deletion occurred, not just that it occurred. VSSAdmin is the most common way to delete shadow copies, but it's not the only one, and detections must account for other