LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Vshadow.exe

View source

VShadow is a command-line tool that can be used to create and manage volume shadow copies.

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1202

Executes specified executable from vshadow.exe.

COMMAND
vshadow.exe -nw -exec={PATH_ABSOLUTE:.exe} C:
USE CASE
Performs execution of specified executable file.
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

C:\Program Files (x86)\Windows Kits\10\bin\<version>\x64\vshadow.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    vshadow.exe usage with -exec parameter

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Ayberk Halaç