Incident responders at managed security firm Huntress have published a detailed breakdown of an attack technique that turns one of Windows’ own built-in backup features against the very organizations it is meant to protect. Investigators spotted the pattern while reviewing suspicious shadow-copy activity on a customer’s domain controller, uncovering a methodical sequence designed to steal an entire Active Directory environment’s credential database while simultaneously destroying the evidence and recovery options that would normally follow.

The Domain Controller’s Crown Jewels

At the center of the attack is NTDS.dit, the database file that underpins every Active Directory domain. It stores password hashes for every user account in the environment, which makes it one of the single highest-value targets an attacker can reach inside a Windows network. Under normal circumstances, NTDS.dit is locked while Active Directory services are running, which prevents it from simply being copied off the disk like an ordinary file.

How the Attack Chain Works

According to Huntress, attackers who have already gained privileged access to a network sidestep that lock using a technique that requires no custom malware at all. The chain typically unfolds as follows:

• The attacker uses PsExec to open a remote command shell on a domain controller with SYSTEM-level privileges
• They perform light reconnaissance, including checking for active Remote Desktop sessions that might reveal defenders or other users on the box
• They run vssadmin create shadow, Windows’ native Volume Shadow Copy Service command, to generate a frozen, point-in-time snapshot of the system volume
• Because the shadow copy is a static snapshot rather than the live, locked database, the attacker can freely copy NTDS.dit out of it
• The attacker then deletes the shadow copies they created, eliminating the built-in local recovery point and making forensic reconstruction harder
• Finally, they perform DNS enumeration and further reconnaissance to identify additional hosts for lateral movement

Once NTDS.dit is exfiltrated, attackers can crack it offline at their leisure, extracting plaintext passwords or password hashes for every account in the domain — including, potentially, domain administrators — without ever tripping the alerts that a live memory-scraping tool might generate.

Why This Technique Is So Effective

Every tool involved in this chain is a legitimate, signed Windows component that IT administrators use for entirely benign purposes every day. VSSAdmin is a standard backup utility; PsExec is a widely used systems administration tool. That “living off the land” quality is precisely what makes the technique so hard to catch with signature-based defenses — nothing about the individual commands looks like malware, and each step has a legitimate administrative explanation on its own.

The added twist of deleting shadow copies after extraction serves two purposes for the attacker: it removes an easy recovery path for defenders, and it can also double as pre-positioning for a later ransomware deployment, since many ransomware operators delete shadow copies specifically to prevent victims from restoring files without paying.

Detection and Defense Recommendations

Huntress recommends that defenders stop evaluating VSSAdmin activity in isolation and instead correlate it with surrounding context. Specific guidance includes:

• Treat shadow-copy creation on domain controllers as a high-priority signal when it coincides with unusual remote execution tools, account activity, or credential-related processes
• Examine process lineage, the user context a command ran under, the role of the host involved, and the timing of the activity relative to normal administrative windows
• Maintain offline or otherwise isolated backup copies that cannot be deleted by an attacker who has already gained local administrative access
• Regularly test backup restoration procedures rather than assuming they will work when needed
• Tightly limit and monitor privileged access to domain controllers, since this entire attack chain depends on the attacker already holding elevated credentials

The report is a reminder that some of the most damaging attacks against enterprise networks don’t rely on exotic malware at all — they simply repurpose the operating system’s own trusted tools against it.