Windows Volume Shadow Copy Service, or VSS, is designed to create point-in-time copies of files and volumes. Administrators and backup products use it to restore data after accidental deletion, corruption, or system failure.
However, attackers increasingly abuse the same Windows feature to steal credentials, disrupt recovery, and prepare ransomware attacks.
Shadow copies are not a complete backup strategy. They are local copies stored on the affected system, meaning attackers with sufficient access can create, alter, or delete them.
Modern ransomware operations often target these copies before encrypting files to make local recovery harder or impossible.
The most familiar VSS attack involves deleting shadow copies before ransomware deployment. Threat actors commonly use built-in Windows utilities such as vssadmin, Windows Management Instrumentation, or other system tools to remove snapshots.
This behavior maps to MITRE ATT&CK technique T1490, Inhibit System Recovery.
Shadow Copies AD Stolen
Deleting shadow copies is not always the final stage of an intrusion. It can be one action in a wider attack chain that includes privilege escalation, lateral movement, data theft, and ransomware encryption. By removing local recovery options first, attackers increase pressure on victims to pay.
VSS can also support credential theft. Instead of directly accessing a live Active Directory database, attackers may create a shadow copy and copy the NTDS.dit file from it.
The file contains Active Directory credential data, including password hashes and other sensitive domain information.
Working from a copied database can help attackers avoid some monitoring controls that focus on live credential-dumping activity.
They can extract secrets from the offline copy and use them to expand access across the network. This makes VSS abuse valuable not only for ransomware groups, but also for intruders seeking domain-wide control.
A third form of abuse involves changing shadow copy storage limits, configurations, or sizes. These changes may reduce available recovery capacity, hide malicious activity, or support later deletion attempts. Security teams should therefore treat VSS activity as a broader attack surface rather than only a backup concern.
Creating or deleting a shadow copy is not automatically malicious. Backup agents, remote monitoring and management tools, and administrator scripts regularly create snapshots or remove old ones to free disk space.
Alerts that trigger on every VSS event would create excessive noise and could cause analysts to miss real threats.
The key is to examine surrounding behavior. A VSS deletion followed by rapid file encryption is far more concerning than a scheduled cleanup task.
Likewise, a shadow copy created after lateral movement and followed by attempts to access NTDS.dit deserves immediate investigation, huntress said.
One observed attack sequence showed why correlation matters. Attackers used PsExec to launch SYSTEM-level command shells on a domain controller.
They then enumerated active Remote Desktop sessions and ran vssadmin create shadow. This was followed by suspected credential harvesting, DNS enumeration, and reconnaissance activity against another host.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
