LOL · Binary

Diskshadow.exe

2 techniquesWindowsLOLBASGPL-3.0

Dump

Credential AccessWindows

Execute commands using diskshadow.exe from a prepared diskshadow script.

Use Use diskshadow to exfiltrate data from VSS such as NTDS.dit

diskshadow.exe /s {PATH:.txt}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Dump
MITRE: T1003.003
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diskshadow.yml
Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml
Elastic: github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml
IOC: Child process from diskshadow.exe
Refs: bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
lolbas-project.github.io/lolbas/Binaries/Diskshadow/

ExecutionWindows

Execute commands using diskshadow.exe to spawn child process

Use Use diskshadow to bypass defensive counter measures

diskshadow> exec {PATH:.exe}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1202
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diskshadow.yml
Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml
Elastic: github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml
IOC: Child process from diskshadow.exe
Refs: bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
lolbas-project.github.io/lolbas/Binaries/Diskshadow/