Windows hackers are exploiting the built-in recovery feature through the Volume Shadow Copy Service to launch disruptions This article explores windows hackers exploiting. . This method seamlessly integrates with normal Windows activities, allowing backup software, remote management tools, and administrators to create or delete shadow copies, leaving defenders with a challenging task to differentiate between routine maintenance and a breach.
Their investigation revealed that multiple linked actions can indicate an attempt to collect credentials, move through the network, and remove local recovery options before the attack reaches its final stage. A stolen directory database can facilitate offline recovery of password hashes and broaden access across an entire domain, as demonstrated in this Active Directory database theft incident.
Regularly used backup agents and remote monitoring tools frequently create or delete copies during scheduled tasks, making a rule that flags every VSS event overly aggressive and likely to overlook genuine intrusions. Huntress linked the suspicious creation event to system-level remote execution, Remote Desktop session checks, credential-focused actions, DNS enumeration, and reconnaissance of at least one additional host. Process lineage, command history, user context, host role, and timing can establish whether a backup operation is expected or part of an intrusion.
Additionally, reviewing alerts in conjunction with VSS (Volume Shadow Copy Service) activity, credential harvesting, or movement between hosts can help identify potential threats.
