Diskshadow.exe

Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).

Dump

Use diskshadow to exfiltrate data from VSS such as NTDS.dit

diskshadow.exe /s {PATH:.txt}

Execute commands using diskshadow.exe from a prepared diskshadow script. — MITRE: T1003.003 — Privileges: User

Execute

Use diskshadow to bypass defensive counter measures

diskshadow> exec {PATH:.exe}

Execute commands using diskshadow.exe to spawn child process — MITRE: T1202 — Privileges: User