Microsoft VSS: Still Essential, But Not the Whole Story
Huntress details Microsoft VSS limits, including a 64TB cap and ransomware deletion of local snapshots.
Stories per day · 30 days
2 RSS
3 stories, newest first · one card per story
Stories tagged #shadow-copy
Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies
Huntress details intruders using PsExec and VSSAdmin on domain controllers to steal NTDS.dit credentials and delete shadow copies before ransomware.
1
How Attackers Abuse VSS, and How Huntress Detects It
Huntress details how attackers abuse Windows Volume Shadow Copies for ransomware recovery sabotage and NTDS.dit credential theft, plus detection logic.