Huntress: distinguishing malicious Volume Shadow Copy abuse (NTDS.dit theft via shadow copy, anti-recovery deletion) from routine RMM/backup housekeeping requires event correlation, not single-event alerting

Huntress lays out three distinct classes of Volume Shadow Copy Service (VSS) abuse it detects, and the correlation logic each requires to separate it from benign RMM- and backup-agent housekeeping that performs the identical raw create/delete API calls constantly (Huntress Labs, 2026-09-14). The first and most familiar class, MITRE ATT&CK's Inhibit System Recovery, is pre-ransomware shadow-copy deletion, most commonly via vssadmin.exe but achievable through several other services and binaries, so a detection that anchors only on the vssadmin.exe process image misses variants. The second, less commonly discussed class is credential access by proxy: rather than running credential-dumping tools live against a monitored host, an attacker creates a shadow copy specifically in order to pull the NTDS.dit Active Directory database out of the static snapshot, a materially quieter path than direct extraction. The third class is shadow-copy size or configuration manipulation as ancillary tradecraft.

Huntress's own detection logic fires on the raw VSS event plus its surrounding context rather than the event in isolation: for deletions, it inspects how the deletion occurred, accounting for the non-vssadmin paths; for creations, it looks for pairing with lateral-movement indicators and credential-harvesting commands appearing before or after the VSS event within a correlation window, rather than judging the creation alone. A worked incident illustrates the method: PsExec spawned a SYSTEM-level shell on a domain controller, the operator enumerated active RDP sessions, ran vssadmin create shadow (the NTDS.dit-theft pattern) then, a few minutes later, attempted to delete the shadow copies to cover their tracks, an attempt endpoint antivirus blocked and flagged, while DNS enumeration against at least one additional host appeared in the same window. Huntress states no single step in that sequence would have justified escalating alone; the lateral-movement-then-VSS-creation-then-credential-harvesting-attempt correlation is what does.

Triage: a shadow copy being created or deleted is one of the most common legitimate Windows operations (routine RMM tooling and backup agents do it constantly) so the raw event carries almost no signal by itself. The discriminator is context: lateral-movement activity and credential-harvesting-adjacent commands appearing in the same time window as the VSS event is what separates an attacker's shadow-copy abuse from a backup agent's routine housekeeping.