Process
diskshadow.exe
diskshadow.exe is a tool for working with Volume Shadow Copies, able to run a scripted sequence of shadow operations. Administrators and backup software use it to create and mount snapshots. Attackers use it to expose locked files like the Active Directory database, and to delete shadow copies, all from a scriptable signed binary.
File identity
Not observed.
Not observed.
Not observed.
Not observed.
Execution context
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Ancestry
Not observed.
Not observed.
Not observed.
Not observed.
Behavior
Not observed.
Not observed.
Not observed.
Not observed.
diskshadow.exe /s {PATH:.txt}Dump · Use diskshadow to exfiltrate data from VSS such as NTDS.ditdiskshadow> exec {PATH:.exe}Execute · Use diskshadow to bypass defensive counter measures
Indicators
Not observed.
Analysis
diskshadow.exe drives the Volume Shadow Copy Service and can run interactively or from a script file. A script chains commands such as set context, create, expose, and delete shadows, which lets it create a snapshot, mount it as a drive letter, and operate on it without interactive input. It requires administrative rights and lives at C:\Windows\System32\diskshadow.exe.
Legitimately, diskshadow is used by backup and storage tooling to manage snapshots, which is uncommon on ordinary endpoints. The script or command sequence it runs is what gives an instance meaning.
diskshadow.exe is a scriptable path to locked credential stores (T1003.003). A short script creates a shadow copy of the system volume, exposes it as a drive, and copies ntds.dit (on a domain controller) or the registry hives out of it, the same goal as the vssadmin and esentutl techniques but driven from a script file that can run non-interactively. Reading ntds.dit from an exposed shadow is the pattern.
It can also delete shadow copies, contributing to recovery inhibition (T1490) like vssadmin delete shadows. Because diskshadow is a legitimate, signed tool and snapshot work is rare on endpoints, the script it runs and the parent that launched it are what separate backup administration from credential theft or ransomware preparation.
- Image path other than
C:\Windows\System32\diskshadow.exehigh - A script that creates and
exposes a shadow copy of the system volumehigh - Reads of
ntds.ditor registry hives from an exposed shadow pathhigh delete shadowsremoving snapshotshigh- Parent is
cmd.exe,powershell.exe, or an unfamiliar processhigh
Telemetry
Not observed.
Not observed.