Diskshadow.exe

Commands

1. DumpUser T1003.003

   Use diskshadow to exfiltrate data from VSS such as NTDS.dit

   diskshadow.exe /s {PATH:.txt}

   Execute commands using diskshadow.exe from a prepared diskshadow script.

   os: Windows server

   Execute: CMD

2. ExecuteUser T1202

   Use diskshadow to bypass defensive counter measures

   diskshadow> exec {PATH:.exe}

   Execute commands using diskshadow.exe to spawn child process

   os: Windows server

   Execute: CMD

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diskshadow.yml
• Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml
• Elastic https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml
• IOCChild process from diskshadow.exe

Resources

• https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/