How Attackers Abuse VSS, and How Huntress Detects It

Attackers are increasingly weaponizing Windows Volume Shadow Copy Service (VSS) for two distinct malicious purposes: credential harvesting from the SYSTEM registry hive and as a defense evasion technique to bypass ransomware recovery. Huntress breaks down the detection logic that separates legitimate backup operations from lateral movement or ransomware staging.

Technical Breakdown

• Primary TTPs: MITRE T1003.001 (OS Credential Dumping: Security Account Manager) via vssadmin or wmic to create shadow copies of C:\Windows\NTDS\ntds.dit and SYSTEM hive; T1490 (Inhibit System Recovery) by deleting shadow copies with vssadmin delete shadows /all /quiet to prevent rollback.
• IOCs: Command-line patterns: vssadmin create shadow /for=C:, vssadmin delete shadows /all, wmic shadowcopy call create Volume='C:\'. Look for ntds.dit or SYSTEM file extraction via copy or reg save immediately after shadow creation.
• Affected Systems: All Windows versions with VSS enabled (default on Server and Workstation).

Defense Huntress EDR correlates VSS activity with parent process lineage (e.g., cmd.exe spawned by rundll32.exe or wscript.exe vs. legitimate backup software). Key detection signal: rapid creation and deletion of shadow copies within minutes, or shadow copy creation followed by file copy operations to a staging directory like C:\Windows\Temp. Block vssadmin.exe execution for non-admin users via AppLocker or WDAC.

Source: https://www.huntress.com/blog/vss-abuse-explained