How Attackers Abuse VSS, and How Huntress Detects It

This report explains how attackers abuse Windows Volume Shadow Copy Service (VSS) for ransomware operations and credential theft, describing deletion of shadow copies to block recovery, creation of shadow copies to extract the NTDS.dit for credential harvesting, and manipulation of shadow copy settings. It emphasizes that VSS creation/deletion are common legitimate activities and that effective detection requires correlating VSS events with contextual signals (e.g., PsExec, lateral movement, credential-harvesting commands) rather than treating isolated VSS events as definitive indicators of compromise.