VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy Service for Ransomware Prep and Credential Theft

Key facts for VSS Shadow Copy abuse

Detection coverage for VSS Shadow Copy abuse

As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2505 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PsExec SYSTEM Shell + RDP Session Enumeration on Domain Controller (SPL)

Detects a PsExec-spawned SYSTEM-privileged command shell (PSEXESVC.exe service artifact) on a domain controller, correlated with native RDP session enumeration (query user / qwinsta) within a 60-minute window. Matches the Huntress-documented VSS-abuse intrusion opener that maps logged-on administrators for lateral movement ahead of credential theft and ransomware staging.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1569.002, T1059.003, T1078.002, T1033, T1018
• Data sources: sysmon, windows_security, windows_system
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=7045)
| append [search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4688]
| eval proc_image=coalesce(Image, NewProcessName)
| eval svc_file=coalesce(ServiceFileName, "")
| eval cmdline=coalesce(CommandLine, "")
| eval is_psexec_svc=if(match(lower(proc_image), "psexesvc\.exe") OR match(lower(svc_file), "psexesvc\.exe"), 1, 0)
| eval is_session_enum=if(match(lower(cmdline), "query\s+user|qwinsta"), 1, 0)
| where (is_psexec_svc=1 OR is_session_enum=1) AND match(Computer, "(?i)^DC[0-9]*$|DOMAINCONTROLLER")
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count, values(cmdline) as commands, values(proc_image) as images, values(EventCode) as event_codes by Computer, User, src_ip
| eval time_window_min=round((last_seen-first_seen)/60,1)
| where count >= 2 AND time_window_min <= 60
| table Computer, User, src_ip, first_seen, last_seen, count, time_window_min, commands, images

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceName matches regex @"(?i)^dc\d*$" or DeviceName has "DOMAINCONTROLLER"
| where (FileName =~ "PSEXESVC.exe" or InitiatingProcessFileName =~ "PSEXESVC.exe")
    or (ProcessCommandLine has_any ("query user", "qwinsta"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), EventCount=count(), Commands=make_set(ProcessCommandLine) by DeviceName, AccountName
| extend WindowMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| where EventCount >= 2 and WindowMinutes <= 60

Sigma

title: PsExec SYSTEM Shell with Session Enumeration on Domain Controller
id: 7c1e9a2e-4b3d-4f6a-9c8e-1a2b3c4d5e6f
status: experimental
description: Detects a PsExec-spawned SYSTEM-level command shell on a domain controller followed by native RDP session enumeration (query user / qwinsta), matching the Huntress-documented VSS-abuse intrusion pattern preceding credential theft and ransomware deployment.
references:
    - https://www.huntress.com/blog/vss-abuse-explained
    - https://attack.mitre.org/techniques/T1569/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-14
tags:
    - attack.execution
    - attack.t1569.002
    - attack.t1059.003
    - attack.privilege-escalation
    - attack.t1078.002
    - attack.discovery
    - attack.t1033
    - attack.t1018
    - attack.tool.psexec
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        Image|endswith: '\PSEXESVC.exe'
    selection_shell:
        ParentImage|endswith: '\PSEXESVC.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    selection_discovery:
        CommandLine|contains:
            - 'query user'
            - 'qwinsta'
    condition: selection_psexec or selection_shell or selection_discovery
falsepositives:
    - Legitimate IT/helpdesk use of PsExec for remote administration
    - Authorized backup or monitoring scripts that enumerate active sessions
level: high

Known false positives:

• Legitimate IT/helpdesk use of PsExec for remote administration on domain controllers
• Authorized backup, monitoring, or session-audit scripts that enumerate active RDP sessions

Tuning notes: Baseline and allowlist the documented backup-service/jump-host accounts and hostnames authorized to run PsExec against domain controllers; raise severity when the PsExec SYSTEM shell is followed within the window by a vssadmin process (see TL-2026-2505-*-002).

• 🔒 PsExec [indicator] Shell + RDP Session Enumeration on Domain Controller (KQL) · unlock with TL Creds
• 🔒 VSS-Based [indicator] and [indicator] Hive Extraction via Shadow Copy (KQL) · unlock with TL Creds
• 🔒 Shadow Copy Deletion or Storage Resize — Inhibit [indicator] Recovery (KQL) · unlock with TL Creds
• 🔒 PsExec [indicator] Shell + RDP Session Enumeration on Domain Controller (Sigma) · unlock with TL Creds
• 🔒 VSS-Based [indicator] and [indicator] Hive Extraction via Shadow Copy (Sigma) · unlock with TL Creds
• 🔒 Shadow Copy Deletion or Storage Resize — Inhibit [indicator] Recovery (Sigma) · unlock with TL Creds
• 🔒 VSS-Based [indicator] and [indicator] Hive Extraction via Shadow Copy (SPL) · unlock with TL Creds
• 🔒 Shadow Copy Deletion or Storage Resize — Inhibit [indicator] Recovery (SPL) · unlock with TL Creds

Indicators of compromise for VSS Shadow Copy abuse

As of 2026-09-14, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-2505.

Sample indicators (1 of 13)

• File hash: 0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

How VSS Shadow Copy abuse works

The reported attack sequence combines PsExec-spawned SYSTEM shells, RDP session enumeration, vssadmin-based shadow-copy operations, and DNS reconnaissance.

Huntress's 'VSS Abuse Explained' (published 2026-09-14, a direct follow-up to its 2026-07-17 'Microsoft VSS: Still Essential, But Not the Whole Story') documents an observed intrusion sequence that abuses Windows' built-in Volume Shadow Copy Service (VSS) for two distinct, complementary adversary goals rather than a single-purpose attack.

First, the attacker used PsExec to spawn a SYSTEM-privileged command shell on a domain controller, then enumerated active Remote Desktop sessions (query user / qwinsta) to map logged-on administrators and identify lateral-movement/impersonation targets. Native DNS reconnaissance followed to support further internal enumeration.

Second, rather than dumping credentials directly from a live LSASS/registry process (which is heavily instrumented by EDR), the attacker created a volume shadow copy with vssadmin create shadow to obtain a point-in-time, lock-free snapshot of the system volume, then copied NTDS.dit and the SYSTEM registry hive out of the shadow device path (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyN\Windows\NTDS\NTDS.dit). This is the same volume-shadow-copy NTDS.dit extraction pattern MITRE ATT&CK documents as T1003.003, first popularized publicly in 2013 and since adopted by threat actors ranging from ransomware-affiliated crews (Wizard Spider) to state-sponsored operators (APT28) and financially motivated groups (Scattered Spider) — because it evades direct-file-read detections that key on LSASS or live NTDS.dit access.

Third, and separately, the attacker attempted vssadmin delete shadows /all /quiet — the canonical T1490 Inhibit System Recovery move used by nearly every major ransomware family (LockBit, Conti, BlackCat, REvil, Ryuk, WannaCry) to remove local recovery points immediately before file encryption, denying the victim a fast local-restore path and increasing ransom leverage. In the observed case this deletion attempt was blocked by antivirus. Huntress also reports manipulation of VSS configuration (e.g., shadow-storage resizing), a less common T1490 variant historically seen in Conti tooling that reduces shadow-copy retention/capacity without an outright delete command, which can achieve a similar recovery-inhibition effect while triggering fewer 'delete shadows' detections.

No CVE, CVSS score, specific threat actor, or network/file IOCs were disclosed in the source article; all commands, tool names, and technique groundings below reflect the general tradecraft as independently documented by MITRE ATT&CK and other primary/vendor sources, not incident-specific artifacts unique to the Huntress-observed intrusion. Huntress's core recommendation is to correlate these VSS-related signals with adjacent lateral-movement, session-enumeration, and credential-harvesting activity within a time window rather than alerting on any single VSS event in isolation, since legitimate backup/DR operations also invoke vssadmin.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping

Discovery

T1018 Remote System Discovery; T1033 System Owner/User Discovery

Lateral Movement

T1021 Remote Services

Execution

T1059 Command and Scripting Interpreter; T1569 System Services

Privilege Escalation

T1078 Valid Accounts

Impact

T1490 Inhibit System Recovery

Remediation for VSS Shadow Copy abuse

Immediate actions

• Alert on vssadmin.exe, wmic.exe (shadowcopy), diskshadow.exe, and wbadmin.exe process creation with delete/resize/quiet arguments, correlated against a short time window with lateral-movement and credential-access signals rather than in isolation.
• Restrict and monitor PsExec / remote service-creation activity against domain controllers; alert on PSEXESVC.exe service installs followed by shadow-copy commands.
• Enable and centrally forward Sysmon Event ID 1 (process creation) and Windows Security 4688 for all domain controllers to detect vssadmin/PsExec chains.
• Restrict who can create/delete/resize shadow copies on domain controllers to a documented, alertable backup-service account and hostname pattern.

Workarounds

• Where feasible, disable interactive/remote vssadmin.exe usage for non-backup-service accounts via AppLocker/WDAC while leaving the VSS service itself enabled for legitimate backup software.
• Restrict SMB admin-share (ADMIN$) access and remote service creation used by PsExec-style tooling to a small, monitored set of jump hosts.

Longer-term hardening

• Deploy EDR/behavioral detection that flags shadow-copy creation immediately followed by reads of \Windows\NTDS\NTDS.dit or \Windows\System32\config\SYSTEM from a HarddiskVolumeShadowCopy device path.
• Maintain offline/immutable backups that are not reachable via VSS deletion or resize, so local shadow-copy destruction does not eliminate all recovery options.
• Enforce least-privilege and tiered administration (Tier 0 isolation) for domain controllers to reduce the population of accounts capable of running vssadmin/PsExec against them.
• Deploy detections (e.g., Elastic's 'Volume Shadow Copy Deleted or Resized via VssAdmin' rule class) mapped to MITRE ATT&CK T1490/T1003.003 and tune against documented legitimate backup-tool baselines.

Affected and fixed versions

• Microsoft — Windows Server (Active Directory Domain Controllers) / Windows Volume Shadow Copy Service
  Vulnerable versions: Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows 10; Windows 11

Timeline of VSS Shadow Copy abuse

• 2013-06-10 Security researcher Rob Fuller (mubix) publishes the first widely-cited public method for remotely extracting locked-ioc-6 domain hashes via Volume Shadow Copy creation, the foundation of what MITRE ATT&CK later formalized as T1003.003.
• 2018-02-10 Researcher bohops publishes 'Vshadow: Abusing the Volume Shadow Service for Evasion, Persistence, and Active Directory Database Extraction,' further documenting VSS-based locked-ioc-6 extraction tradecraft.
• 2019-04-02 MITRE ATT&CK formally catalogs Inhibit locked-ioc-10 Recovery as Enterprise technique T1490, documenting locked-ioc-7/wbadmin/bcdedit/diskshadow shadow-copy and backup destruction as a ransomware-impact technique.
• 2020-02-11 MITRE ATT&CK formally catalogs OS Credential Dumping: NTDS as sub-technique T1003.003, documenting volume-shadow-copy-based locked-ioc-6 extraction as used by locked-ioc-5, APT28, Fox Kitten, Mustang Panda, locked-ioc-2, and MirrorFace.
• 2021-11-17 CrowdStrike publishes analysis of locked-ioc-9 2.0 ransomware's locked-ioc-7/wmic/bcdedit shadow-copy tampering chain, including a documented SHA256 sample, and how Falcon detects/prevents it.
• 2026-07-17 Huntress publishes 'Microsoft VSS: Still Essential, But Not the Whole Story,' examining VSS's architectural limitations as a recovery mechanism — the direct predecessor article to the VSS-abuse follow-up.
• 2026-09-14 Huntress publishes 'VSS Abuse Explained,' documenting an observed attack sequence combining PsExec-spawned locked-ioc-10 shells, RDP session enumeration, vssadmin-based shadow-copy creation (locked-ioc-6 extraction) and deletion (recovery inhibition, blocked by antivirus), VSS configuration manipulation, and DNS reconnaissance.

Sources cited for VSS Shadow Copy abuse

• Inhibit System Recovery (T1490) - Eviction Strategies Tool CISA · Government advisory · 2026-05-12
• Inhibit System Recovery, Technique T1490 - Enterprise | MITRE ATT&CK MITRE · Research · 2026-05-12
• OS Credential Dumping: NTDS, Sub-technique T1003.003 | MITRE ATT&CK MITRE · Research · 2026-05-12
• Behavioral Detection for T1490 - Inhibit System Recovery, Detection Strategy DET0329 | MITRE ATT&CK MITRE · Research · 2026-01-01
• How CrowdStrike Prevents Volume Shadow Tampering by LockBit Ransomware CrowdStrike · Vendor report · 2021-11-17
• Volume Shadow Copy Deleted or Resized via VssAdmin elastic.co · Vendor report · 2026-01-01
• Extracting Domain Hashes: VSSAdmin akimbocore.com · Research · 2026-01-01
• PsExec NTDS.dit And SYSTEM Hive Download Utility Rapid7 · Vendor report · 2026-01-01
• When AD Gets Breached: Detecting NTDS.dit Dumps and Exfiltration with Trellix NDR trellix.com · Vendor report · 2026-01-01
• VSS Abuse Explained Huntress · Blog · 2026-09-14
• Microsoft VSS: Still Essential, But Not the Whole Story Huntress · Blog · 2026-07-17
• Volume Shadow Copy NTDS.dit Domain Hashes Remotely - Part 1 malicious.link · Blog · 2013-06-10
• Vshadow: Abusing the Volume Shadow Service for Evasion, Persistence, and Active Directory Database Extraction bohops.com · Blog · 2018-02-10

More in threat intel

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• ARTEX agentic AI offensive framework abuse expands as Storm-3358 targets financial sector
• Brute Force Attacks Against Internet-Exposed RDP/RD Gateway/RDWeb, SSH and macOS Logins (Huntress Brute Force Sentry)
• OpenAI GPT-6 Cyber AI Model Finds 81 Firefox Flaws and Develops Root Exploits for 948 Linux Kernel Flaws
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism

Previous and next in threat intel

• Blockchain-Based C2 Evolution: Nation-State Actors Adopt Smart-Contract C2 (EtherHiding, JADESNOW/INVISIBLEFERRET, SharkStealer) Previous report
• Rehub: Russian-Language Ransomware-as-a-Service Marketplace Absorbing RAMP's Displaced Operators Next report