Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). Located at: C:\Windows\System32\diskshadow.exe; C:\Windows\SysWOW64\diskshadow.exe.
diskshadowdiskshadowSandbox: execFile · Timeout: 30s
credential.dump security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Execute commands using diskshadow.exe from a prepared diskshadow script. (Use diskshadow to exfiltrate data from VSS such as NTDS.dit)
diskshadow.exe /s {PATH:.txt}Execute commands using diskshadow.exe to spawn child process (Use diskshadow to bypass defensive counter measures)
diskshadow> exec {PATH:.exe}diskshadow is a Windows LOLBin. Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). Located at: C:\Windows\System32\diskshadow.exe; C:\Windows\SysWOW64\diskshadow.exe.