LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Diskshadow.exe

View source

Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).

DumpExecute
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
03DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Dump1

EXAMPLE 01T1003.003

Execute commands using diskshadow.exe from a prepared diskshadow script.

COMMAND
diskshadow.exe /s {PATH:.txt}
USE CASE
Use diskshadow to exfiltrate data from VSS such as NTDS.dit
PRIVILEGES
User
OPERATING SYSTEM
Windows server
Execute · CMD

Execute1

EXAMPLE 01T1202

Execute commands using diskshadow.exe to spawn child process

COMMAND
diskshadow> exec {PATH:.exe}
USE CASE
Use diskshadow to bypass defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows server
Execute · CMD
02 / ON DISK

Known paths

C:\Windows\System32\diskshadow.exe
C:\Windows\SysWOW64\diskshadow.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    Child process from diskshadow.exe

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Jimmy@bohops