Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies
Huntress details intruders using PsExec and VSSAdmin on domain controllers to steal NTDS.dit credentials and delete shadow copies before ransomware.
Huntress analysts identified attackers launching SYSTEM-level command shells via PsExec on a domain controller, then running 'vssadmin create shadow' to snapshot and copy the NTDS.dit Active Directory database. Shadow copies were later deleted to destroy local recovery options ahead of a likely ransomware stage. Huntress recommends correlating VSS creation/deletion events with remote execution, DNS enumeration, and lateral movement rather than alerting on any single VSS event.
- PsExec SYSTEM-level execution preceded shadow-copy creation on a domain controller
- vssadmin create shadow used to snapshot NTDS.dit for offline credential recovery
- Shadow-copy deletion narrows recovery options before ransomware final stage
- Huntress urges correlating VSS events with remote execution, DNS enumeration, lateral movement
From the original article
3 min read at cybersecuritynews.com
Windows attackers are turning a built-in recovery feature into a tool for disruption. By abusing Volume Shadow Copy Service, intruders can copy protected data, access the Active Directory database, and erase recovery copies after ransomware. The technique blends into Windows activity.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.