Which SIEM platforms have a T1006 detection rule?

df00tech provides T1006 (Direct Volume Access) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1006 detection?

The T1006 detection is rated high severity with high confidence.

What are common false positives for T1006?

Common false positives for T1006 include: Legitimate backup software (Veeam, Acronis, Windows Server Backup) uses VSS APIs and vssadmin/wbadmin to create and manage shadow copies as part of normal backup jobs — correlate with scheduled backup windows; Database administrators using esentutl for legitimate NTDS or Exchange database maintenance, repair, or integrity checks — verify against change management tickets; Windows built-in System Restore and automatic shadow copy creation triggered by system updates or restore point schedules — check InitiatingProcessFileName for svchost.exe or vssvc.exe as parent.

T1006

Direct Volume Access

Q: What data sources are required to detect Direct Volume Access (T1006)?

Detecting Direct Volume Access requires the following data sources: Process: Process Creation, Command: Command Execution, File: File Access, Microsoft Defender for Endpoint.

Defense Evasion Last updated: April 13, 2026

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes, enabling reads and writes directly from the drive by analyzing file system data structures. This technique bypasses Windows file access controls and file system monitoring tools. Utilities such as NinjaCopy (PowerShell), vssadmin, wbadmin, and esentutl can be used to create shadow copies or access locked files (such as ntds.dit, SYSTEM hive, and SAM) directly from disk. Real-world actors including Scattered Spider and Volt Typhoon have leveraged Volume Shadow Copy Service (VSS) to extract credential stores without triggering standard file access controls.

What is T1006 Direct Volume Access?

Direct Volume Access (T1006) maps to the Defense Evasion tactic — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for Direct Volume Access, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, File: File Access, Microsoft Defender for Endpoint. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1006 Direct Volume Access
Canonical reference: https://attack.mitre.org/techniques/T1006/

Microsoft Sentinel / Defender

kusto

let DirectVolumePatterns = dynamic([
  "HarddiskVolumeShadowCopy", "GLOBALROOT\\Device\\",
  "\\\\.\\PhysicalDrive", "\\\\.\\HarddiskVolume",
  "\\\\?\\GLOBALROOT", "vssadmin", "diskshadow"
]);
let CredentialTargets = dynamic([
  "ntds.dit", "ntds.jfm", "NTDS.dit",
  "SAM", "SECURITY", "SYSTEM",
  "NTUSER.DAT", "security.bak"
]);
let SuspiciousTools = dynamic([
  "esentutl.exe", "vssadmin.exe", "wbadmin.exe",
  "diskshadow.exe", "ntdsutil.exe"
]);
// Branch 1: Shadow copy creation and manipulation tools
let ShadowCopyOps = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (SuspiciousTools)
| where ProcessCommandLine has_any ("create shadow", "list shadows", "delete shadows",
    "/y ", "/vss", "start backup", "ifm", "activate instance",
    "set context", "add volume", "expose", "HarddiskVolumeShadowCopy", "GLOBALROOT")
| extend DetectionBranch = "ShadowCopyOrVSSToolUsage"
| extend TargetsCredentials = ProcessCommandLine has_any (CredentialTargets);
// Branch 2: Direct volume path access in any process command line
let DirectVolumeOps = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (DirectVolumePatterns)
| where not (FileName in~ ("vssvc.exe", "svchost.exe", "WmiPrvSE.exe"))
| extend DetectionBranch = "DirectVolumePathInCommandLine"
| extend TargetsCredentials = ProcessCommandLine has_any (CredentialTargets);
// Branch 3: PowerShell NinjaCopy or raw disk access
let NinjaCopyOps = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (
    "NinjaCopy", "Invoke-NinjaCopy",
    "GetDriveGeometry", "FSCTL_GET_NTFS_VOLUME_DATA",
    "DeviceIoControl", "CreateFile.*\\\\\\.\\\\Harddisk",
    "PhysicalDrive", "HarddiskVolume"
  )
| extend DetectionBranch = "PowerShellDirectVolumeAccess"
| extend TargetsCredentials = ProcessCommandLine has_any (CredentialTargets);
// Branch 4: File events — reads from shadow copy paths
let ShadowCopyFileAccess = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any ("HarddiskVolumeShadowCopy", "GLOBALROOT\\Device")
| where FileName has_any (CredentialTargets)
| extend DetectionBranch = "CredentialFileReadFromShadowCopy"
| extend TargetsCredentials = true
| project Timestamp, DeviceName, AccountName,
    FileName, FolderPath, InitiatingProcessFileName,
    InitiatingProcessCommandLine, DetectionBranch, TargetsCredentials;
union
  (ShadowCopyOps | project Timestamp, DeviceName, AccountName, FileName,
    ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine,
    DetectionBranch, TargetsCredentials),
  (DirectVolumeOps | project Timestamp, DeviceName, AccountName, FileName,
    ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine,
    DetectionBranch, TargetsCredentials),
  (NinjaCopyOps | project Timestamp, DeviceName, AccountName, FileName,
    ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine,
    DetectionBranch, TargetsCredentials)
| sort by Timestamp desc
| extend RiskScore = case(
    TargetsCredentials == true, "Critical",
    DetectionBranch == "PowerShellDirectVolumeAccess", "High",
    DetectionBranch == "ShadowCopyOrVSSToolUsage", "Medium",
    "Medium"
  )

Detects direct volume access patterns across four detection branches: (1) shadow copy creation and manipulation tools (vssadmin, esentutl, diskshadow, ntdsutil, wbadmin) with suspicious flags; (2) any process with direct volume path references (\\?\GLOBALROOT, PhysicalDrive, HarddiskVolumeShadowCopy) in command lines; (3) PowerShell-based direct volume access tools such as NinjaCopy; and (4) file read events targeting credential stores (ntds.dit, SAM, SYSTEM) from shadow copy device paths. Risk scoring escalates when credential file targets are identified. Uses both DeviceProcessEvents and DeviceFileEvents from Microsoft Defender for Endpoint.

high severity high confidence

Data Sources

Process: Process Creation Command: Command Execution File: File Access Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceFileEvents

False Positives

Legitimate backup software (Veeam, Acronis, Windows Server Backup) uses VSS APIs and vssadmin/wbadmin to create and manage shadow copies as part of normal backup jobs — correlate with scheduled backup windows
Database administrators using esentutl for legitimate NTDS or Exchange database maintenance, repair, or integrity checks — verify against change management tickets
Windows built-in System Restore and automatic shadow copy creation triggered by system updates or restore point schedules — check InitiatingProcessFileName for svchost.exe or vssvc.exe as parent
Security and compliance tools (CyberArk, BeyondTrust, Varonis) that enumerate shadow copies during privileged access audits or data classification scans
Forensic and incident response tooling run by authorized responders using disk imaging utilities that access raw volumes

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  (Image="*\\vssadmin.exe" AND (CommandLine="*create shadow*" OR CommandLine="*list shadows*" OR CommandLine="*delete shadow*"))
  OR (Image="*\\esentutl.exe" AND (CommandLine="*HarddiskVolumeShadowCopy*" OR CommandLine="*GLOBALROOT*" OR CommandLine="*/y *" OR CommandLine="*/vss*"))
  OR (Image="*\\diskshadow.exe")
  OR (Image="*\\ntdsutil.exe" AND (CommandLine="*ifm*" OR CommandLine="*activate instance*" OR CommandLine="*ntds*"))
  OR (Image="*\\wbadmin.exe" AND (CommandLine="*start backup*" OR CommandLine="*start recovery*"))
  OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*NinjaCopy*" OR CommandLine="*Invoke-NinjaCopy*" OR CommandLine="*PhysicalDrive*" OR CommandLine="*HarddiskVolumeShadowCopy*" OR CommandLine="*GLOBALROOT*"))
  OR CommandLine="*\\\\.\\PhysicalDrive*"
  OR CommandLine="*GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*"
)
| eval ToolCategory=case(
    match(Image, "vssadmin\.exe"), "ShadowCopyManagement",
    match(Image, "esentutl\.exe"), "EsentutlVSS",
    match(Image, "diskshadow\.exe"), "DiskShadow",
    match(Image, "ntdsutil\.exe"), "NtdsutilIFM",
    match(Image, "wbadmin\.exe"), "WindowsBackup",
    (match(Image, "powershell\.exe") OR match(Image, "pwsh\.exe")), "PowerShellVolumeAccess",
    true(), "DirectVolumeAccess"
  )
| eval TargetsCredentials=if(
    match(lower(CommandLine), "(ntds\.dit|ntds\.jfm|\bsam\b|\bsecurity\b|\bsystem\b|ntuser\.dat)"),
    1, 0
  )
| eval RiskScore=case(
    TargetsCredentials=1, "Critical",
    ToolCategory="PowerShellVolumeAccess", "High",
    ToolCategory="EsentutlVSS", "High",
    ToolCategory="NtdsutilIFM", "High",
    true(), "Medium"
  )
| eval CommandLine=CommandLine
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
         ToolCategory, TargetsCredentials, RiskScore
| sort - _time

Detects direct volume access using Sysmon Event ID 1 (Process Creation). Covers vssadmin shadow copy operations, esentutl with VSS paths, diskshadow execution, ntdsutil IFM (Install From Media) mode used to dump NTDS, wbadmin backup operations, and PowerShell-based direct volume access tools including NinjaCopy. Evaluates command lines for credential file targets (ntds.dit, SAM, SYSTEM) to assign risk scores. Detects raw device path patterns (\\.\ PhysicalDrive, GLOBALROOT\Device\HarddiskVolumeShadowCopy) in any process context.

high severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Legitimate backup software (Veeam, Acronis, Windows Server Backup) uses vssadmin and wbadmin for scheduled backup jobs — correlate with known backup windows and parent processes
Database administrators running esentutl for NTDS or Exchange database maintenance and integrity checks — validate against change management records
IT provisioning and domain replication tools (DFS-R, Active Directory replication) that interact with VSS for consistent snapshots
Security scanning and DLP tools that enumerate shadow copies for data classification or compliance purposes
Authorized penetration testers or red team operators performing credential extraction simulations — verify authorization documentation

Elastic Security (EQL)

eql

any where
  (
    event.category == "process" and event.type == "start" and
    (
      (
        process.name in~ ("vssadmin.exe", "esentutl.exe", "diskshadow.exe", "ntdsutil.exe", "wbadmin.exe") and
        process.command_line like~ ("*create shadow*", "*list shadow*", "*delete shadow*",
          "*HarddiskVolumeShadowCopy*", "*GLOBALROOT*", "*ifm*", "*activate instance*",
          "*start backup*", "*start recovery*", "*/y *", "*/vss*")
      ) or
      (
        process.name in~ ("powershell.exe", "pwsh.exe") and
        process.command_line like~ ("*NinjaCopy*", "*Invoke-NinjaCopy*", "*PhysicalDrive*",
          "*HarddiskVolumeShadowCopy*", "*GLOBALROOT*", "*GetDriveGeometry*",
          "*FSCTL_GET_NTFS_VOLUME_DATA*", "*DeviceIoControl*")
      ) or
      (
        process.command_line like~ ("*PhysicalDrive*", "*HarddiskVolumeShadowCopy*", "*HarddiskVolume*") and
        not process.name in~ ("vssvc.exe", "svchost.exe", "wmiprvse.exe")
      )
    )
  ) or
  (
    event.category == "file" and
    file.path like~ ("*HarddiskVolumeShadowCopy*", "*GLOBALROOT*") and
    file.name in~ ("ntds.dit", "ntds.jfm", "sam", "security", "system", "ntuser.dat", "security.bak")
  )

Detects T1006 Direct Volume Access using Elastic ECS process and file events. Four branches: (1) VSS management tool abuse via vssadmin, esentutl, diskshadow, ntdsutil, wbadmin with suspicious arguments; (2) PowerShell-based raw disk access including NinjaCopy and low-level volume APIs; (3) direct volume path strings in any non-system process command line; (4) file access events reading credential store files from shadow copy paths.

critical severity high confidence

Data Sources

Elastic Endpoint Security agent (process and file event telemetry) Winlogbeat with Sysmon module (Event ID 1, Event ID 11) Elastic Agent Windows integration with command-line auditing

Required Tables

logs-endpoint.events.process-* logs-endpoint.events.file-* logs-windows.sysmon_operational-*

False Positives

Enterprise backup software (Veeam, Acronis, Windows Server Backup, Azure Backup agent) that invokes vssadmin.exe or wbadmin.exe on scheduled backup jobs — particularly noisy on dedicated backup servers and domain controllers with regular snapshot schedules
IT administrators performing authorized Active Directory maintenance using ntdsutil.exe with IFM arguments for domain controller promotion media creation, or esentutl.exe for offline NTDS defragmentation
Endpoint detection and response platforms or forensic tools that enumerate shadow copies, scan VSS snapshots for malware, or perform integrity checks using raw volume access as part of their normal sensor activity

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceHost,
  username AS UserName,
  "ProcessImage" AS ProcessImage,
  "CommandLine" AS CommandLine,
  "ParentImage" AS ParentProcess,
  CASE
    WHEN LOWER("CommandLine") LIKE '%ntds.dit%'
      OR LOWER("CommandLine") LIKE '%ntds.jfm%'
      OR LOWER("CommandLine") LIKE '%ntuser.dat%'
      OR LOWER("CommandLine") LIKE '%security.bak%'
      THEN 'Critical'
    WHEN "ProcessImage" LIKE '%powershell.exe'
      OR "ProcessImage" LIKE '%pwsh.exe'
      OR "ProcessImage" LIKE '%ntdsutil.exe'
      OR "ProcessImage" LIKE '%esentutl.exe'
      THEN 'High'
    ELSE 'Medium'
  END AS RiskScore,
  CASE
    WHEN "ProcessImage" LIKE '%vssadmin.exe'   THEN 'ShadowCopyManagement'
    WHEN "ProcessImage" LIKE '%esentutl.exe'   THEN 'EsentutlVSS'
    WHEN "ProcessImage" LIKE '%diskshadow.exe' THEN 'DiskShadow'
    WHEN "ProcessImage" LIKE '%ntdsutil.exe'   THEN 'NtdsutilIFM'
    WHEN "ProcessImage" LIKE '%wbadmin.exe'    THEN 'WindowsBackup'
    WHEN "ProcessImage" LIKE '%powershell.exe'
      OR "ProcessImage" LIKE '%pwsh.exe'       THEN 'PowerShellVolumeAccess'
    ELSE 'DirectVolumeAccess'
  END AS ToolCategory
FROM events
WHERE
  (
    (
      "ProcessImage" LIKE '%vssadmin.exe' AND
      ("CommandLine" LIKE '%create shadow%' OR "CommandLine" LIKE '%list shadow%' OR "CommandLine" LIKE '%delete shadow%')
    ) OR (
      "ProcessImage" LIKE '%esentutl.exe' AND
      ("CommandLine" LIKE '%HarddiskVolumeShadowCopy%' OR "CommandLine" LIKE '%GLOBALROOT%'
        OR "CommandLine" LIKE '%/y %' OR "CommandLine" LIKE '%/vss%')
    ) OR
      "ProcessImage" LIKE '%diskshadow.exe'
    OR (
      "ProcessImage" LIKE '%ntdsutil.exe' AND
      ("CommandLine" LIKE '%ifm%' OR "CommandLine" LIKE '%activate instance%' OR "CommandLine" LIKE '%ntds%')
    ) OR (
      "ProcessImage" LIKE '%wbadmin.exe' AND
      ("CommandLine" LIKE '%start backup%' OR "CommandLine" LIKE '%start recovery%')
    ) OR (
      ("ProcessImage" LIKE '%powershell.exe' OR "ProcessImage" LIKE '%pwsh.exe') AND
      ("CommandLine" LIKE '%NinjaCopy%' OR "CommandLine" LIKE '%Invoke-NinjaCopy%'
        OR "CommandLine" LIKE '%PhysicalDrive%' OR "CommandLine" LIKE '%HarddiskVolumeShadowCopy%'
        OR "CommandLine" LIKE '%GLOBALROOT%')
    ) OR
      "CommandLine" LIKE '%PhysicalDrive%'
    OR
      "CommandLine" LIKE '%GLOBALROOT%HarddiskVolumeShadowCopy%'
  )
ORDER BY starttime DESC
LAST 24 HOURS

IBM QRadar AQL query detecting T1006 Direct Volume Access against Sysmon process creation events normalized via WinCollect DSM. Queries custom properties ProcessImage and CommandLine (populated by the Microsoft Windows Sysmon DSM parser) for VSS tool abuse, direct volume path access, and PowerShell raw disk API usage. Risk scoring and tool categorization are computed inline. Note: custom property names vary by DSM configuration — adjust ProcessImage and CommandLine field references to match your QRadar deployment's Sysmon DSM property mappings.

critical severity high confidence

Data Sources

IBM QRadar with Microsoft Windows WinCollect agent (Sysmon Event ID 1) Windows Security Event Log via WinCollect (Event ID 4688 with process command-line auditing enabled) QRadar Microsoft Windows Sysmon DSM for custom property extraction

Required Tables

events

False Positives

Enterprise backup solutions (Veeam Backup & Replication, Commvault, NetBackup, SCDPM) running on backup servers invoke vssadmin.exe and wbadmin.exe routinely during scheduled jobs — expect sustained false positive volume from backup infrastructure hosts
Active Directory infrastructure teams creating IFM installation media for domain controller promotion using ntdsutil.exe 'activate instance ntds' and 'ifm' commands — indistinguishable from attacker use without additional context on the initiating account and host
PowerShell-based infrastructure automation scripts that reference HarddiskVolume paths for disk health checks, storage management, or scripted backup operations will match the PowerShellVolumeAccess category

Sumo Logic CSE

sql

(_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where _raw matches "*EventID=1*" OR _raw matches "*EventCode=1*" OR _raw matches "*EventID=4688*" OR _raw matches "*EventCode=4688*"
| parse "Image=*\n" as ProcessImage nodrop
| parse "CommandLine=*\n" as CommandLine nodrop
| parse "ParentImage=*\n" as ParentImage nodrop
| parse "ParentCommandLine=*\n" as ParentCommandLine nodrop
| parse "User=*\n" as User nodrop
| parse "Computer=*\n" as Computer nodrop
| where (
    (ProcessImage matches "*vssadmin.exe*" AND (
      CommandLine matches "*create shadow*" OR CommandLine matches "*list shadow*" OR CommandLine matches "*delete shadow*"
    )) OR
    (ProcessImage matches "*esentutl.exe*" AND (
      CommandLine matches "*HarddiskVolumeShadowCopy*" OR CommandLine matches "*GLOBALROOT*"
      OR CommandLine matches "*/y *" OR CommandLine matches "*/vss*"
    )) OR
    ProcessImage matches "*diskshadow.exe*" OR
    (ProcessImage matches "*ntdsutil.exe*" AND (
      CommandLine matches "*ifm*" OR CommandLine matches "*activate instance*" OR CommandLine matches "*ntds*"
    )) OR
    (ProcessImage matches "*wbadmin.exe*" AND (
      CommandLine matches "*start backup*" OR CommandLine matches "*start recovery*"
    )) OR
    ((ProcessImage matches "*powershell.exe*" OR ProcessImage matches "*pwsh.exe*") AND (
      CommandLine matches "*NinjaCopy*" OR CommandLine matches "*Invoke-NinjaCopy*"
      OR CommandLine matches "*PhysicalDrive*" OR CommandLine matches "*HarddiskVolumeShadowCopy*"
      OR CommandLine matches "*GLOBALROOT*" OR CommandLine matches "*GetDriveGeometry*"
    )) OR
    CommandLine matches "*PhysicalDrive*" OR
    CommandLine matches "*GLOBALROOT*HarddiskVolumeShadowCopy*"
  )
| eval ToolCategory = if(ProcessImage matches "*vssadmin.exe*", "ShadowCopyManagement",
    if(ProcessImage matches "*esentutl.exe*", "EsentutlVSS",
    if(ProcessImage matches "*diskshadow.exe*", "DiskShadow",
    if(ProcessImage matches "*ntdsutil.exe*", "NtdsutilIFM",
    if(ProcessImage matches "*wbadmin.exe*", "WindowsBackup",
    if(ProcessImage matches "*powershell.exe*" OR ProcessImage matches "*pwsh.exe*",
      "PowerShellVolumeAccess", "DirectVolumeAccess"))))))
| eval TargetsCredentials = if(
    toLowerCase(CommandLine) matches "*(ntds.dit|ntds.jfm|ntuser.dat|security.bak)*",
    "true", "false")
| eval RiskScore = if(TargetsCredentials = "true", "Critical",
    if(ToolCategory = "PowerShellVolumeAccess", "High",
    if(ToolCategory = "NtdsutilIFM", "High",
    if(ToolCategory = "EsentutlVSS", "High", "Medium"))))
| fields _messagetime, Computer, User, ProcessImage, CommandLine, ParentImage, ParentCommandLine, ToolCategory, TargetsCredentials, RiskScore
| sort by _messagetime desc

Sumo Logic query detecting T1006 Direct Volume Access by parsing Sysmon Event ID 1 and Windows Security Event ID 4688 process creation events. Uses field extraction to parse Image, CommandLine, and parent process fields from raw event data, then applies multi-branch detection logic covering VSS tool abuse, direct volume paths, and PowerShell raw disk access. Enriches each event with tool category, credential targeting flag, and risk score.

critical severity high confidence

Data Sources

Sumo Logic Installed Collector with Windows Event Log source (Sysmon Operational channel) Sumo Logic Windows Event Log source (Security channel, Event ID 4688 with enhanced command-line auditing GPO) Sumo Logic Cloud SIEM with Windows normalized schema

Required Tables

_sourceCategory=*windows* _sourceCategory=*sysmon*

False Positives

Scheduled backup agents (Veeam, Backup Exec, Windows Server Backup service) that invoke vssadmin.exe and wbadmin.exe on backup servers during maintenance windows — add backup server hostnames to a suppression list to reduce noise
Legitimate domain controller IFM media creation during AD deployment procedures using ntdsutil.exe — the 'activate instance ntds' and 'ifm' argument pattern is identical to attacker technique; cross-reference with change management tickets
PowerShell-based disk health monitoring scripts and storage management automation that reference HarddiskVolume or PhysicalDrive paths for SMART data collection or disk capacity reporting

Google Chronicle / SecOps

yaral

rule T1006_Direct_Volume_Access {
  meta:
    author = "Detection Engineering"
    description = "Detects T1006 Direct Volume Access - VSS shadow copy manipulation tools, direct physical volume path access, and PowerShell-based raw disk API usage targeting credential stores (ntds.dit, SAM, SECURITY)"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1006"
    severity = "HIGH"
    confidence = "HIGH"
    platform = "Windows"
    created = "2024-01-01"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        re.regex($e.target.process.file.full_path,
          `(?i)(vssadmin|esentutl|diskshadow|ntdsutil|wbadmin)\.exe$`) and
        re.regex($e.target.process.command_line,
          `(?i)(create shadow|list shadow|delete shadow|HarddiskVolumeShadowCopy|GLOBALROOT|\/y |\/vss|ifm|activate instance|set context|add volume|start backup|start recovery)`)
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line,
          `(?i)(NinjaCopy|Invoke-NinjaCopy|PhysicalDrive|HarddiskVolumeShadowCopy|GLOBALROOT|GetDriveGeometry|FSCTL_GET_NTFS_VOLUME_DATA|DeviceIoControl)`)
      ) or
      (
        re.regex($e.target.process.command_line,
          `(?i)(PhysicalDrive|HarddiskVolumeShadowCopy|HarddiskVolume[0-9]|GLOBALROOT)`) and
        not re.regex($e.target.process.file.full_path, `(?i)(vssvc|svchost|wmiprvse)\.exe$`)
      )
    )

  condition:
    $e
}

Chronicle YARA-L 2.0 detection rule for T1006 Direct Volume Access operating on UDM PROCESS_LAUNCH events. Three detection branches: (1) known VSS/volume management tools (vssadmin, esentutl, diskshadow, ntdsutil, wbadmin) with suspicious arguments indicating shadow copy manipulation or credential access; (2) PowerShell processes invoking raw disk APIs or NinjaCopy tool variants; (3) any non-system process with direct volume path strings in the command line. Uses re.regex with backtick raw strings for clean pattern matching without double-escaping.

critical severity high confidence

Data Sources

Google Chronicle with Chronicle Forwarder agent deployed on Windows endpoints Windows Event Log forwarding to Chronicle via Forwarder (Sysmon Event ID 1, Security Event ID 4688) Chronicle Unified Data Model (UDM) PROCESS_LAUNCH event normalization

Required Tables

UDM PROCESS_LAUNCH events

False Positives

Enterprise backup infrastructure systems (Veeam backup servers, Azure Backup MARs agent, Windows Server Backup scheduled tasks) that legitimately invoke vssadmin.exe and wbadmin.exe — create reference list exclusions for known backup service account UPNs and backup server hostnames in Chronicle
Active Directory engineers creating IFM installation media for new domain controller deployments using ntdsutil.exe — this produces an exact pattern match on 'activate instance ntds' and 'ifm' that is operationally indistinguishable at the command-line level; correlate against approved change requests
EDR and security tooling (Carbon Black, SentinelOne, CrowdStrike Falcon) that periodically access raw volume data or shadow copy paths as part of behavioral monitoring, forensic snapshot collection, or integrity baseline operations

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| test(
    (FileName == "vssadmin.exe" and (CommandLine = /(?i)create shadow/ or CommandLine = /(?i)list shadow/ or CommandLine = /(?i)delete shadow/))
    or (FileName == "esentutl.exe" and (CommandLine = /(?i)HarddiskVolumeShadowCopy/ or CommandLine = /(?i)GLOBALROOT/ or CommandLine = /\/y / or CommandLine = /\/vss/))
    or FileName == "diskshadow.exe"
    or (FileName == "ntdsutil.exe" and (CommandLine = /(?i)ifm/ or CommandLine = /(?i)activate instance/ or CommandLine = /(?i)ntds/))
    or (FileName == "wbadmin.exe" and (CommandLine = /(?i)start backup/ or CommandLine = /(?i)start recovery/))
    or (FileName in ("powershell.exe", "pwsh.exe") and (CommandLine = /(?i)NinjaCopy/ or CommandLine = /(?i)Invoke-NinjaCopy/ or CommandLine = /(?i)PhysicalDrive/ or CommandLine = /(?i)HarddiskVolumeShadowCopy/ or CommandLine = /(?i)GLOBALROOT/ or CommandLine = /(?i)GetDriveGeometry/))
    or CommandLine = /(?i)PhysicalDrive/
    or CommandLine = /(?i)GLOBALROOT.*HarddiskVolumeShadowCopy/
  )
| ToolCategory := case {
    FileName == "vssadmin.exe"   => "ShadowCopyManagement";
    FileName == "esentutl.exe"   => "EsentutlVSS";
    FileName == "diskshadow.exe" => "DiskShadow";
    FileName == "ntdsutil.exe"   => "NtdsutilIFM";
    FileName == "wbadmin.exe"    => "WindowsBackup";
    FileName in ("powershell.exe", "pwsh.exe") => "PowerShellVolumeAccess";
    *                            => "DirectVolumeAccess"
  }
| TargetsCredentials := if(CommandLine = /(?i)(ntds\.dit|ntds\.jfm|ntuser\.dat|security\.bak)/, "true", "false")
| RiskScore := case {
    TargetsCredentials == "true"                                                    => "Critical";
    ToolCategory in ("PowerShellVolumeAccess", "NtdsutilIFM", "EsentutlVSS")      => "High";
    *                                                                               => "Medium"
  }
| groupBy(
    [ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine,
     ToolCategory, TargetsCredentials, RiskScore],
    function=count(as=EventCount)
  )
| sort(field=RiskScore, order=desc)

CrowdStrike LogScale (Falcon) CQL query detecting T1006 Direct Volume Access using ProcessRollup2 events from the Falcon sensor. Applies regex-based branch matching for VSS management tools, direct volume path references, and PowerShell raw disk access. Enriches each process event with ToolCategory classification, TargetsCredentials flag for credential store targeting, and a tiered RiskScore. Results are grouped by unique process invocation profile to surface repeated activity patterns and reduce duplicate alert noise.

critical severity high confidence

Data Sources

CrowdStrike Falcon sensor process telemetry (ProcessRollup2 events) CrowdStrike Humio / LogScale SIEM with Falcon data connector Falcon Data Replicator (FDR) event stream

Required Tables

ProcessRollup2

False Positives

Windows Server Backup and third-party backup agents (Veeam, Backup Exec) running under privileged service accounts that invoke vssadmin.exe and wbadmin.exe on scheduled backup jobs — particularly common on file servers, domain controllers, and Exchange servers; add backup host CIDs or service account names to an exclusion reference list
CrowdStrike Falcon sensor itself and competing EDR products may invoke volume-level APIs or reference VSS paths for their own behavioral monitoring, file scanning, or forensic telemetry collection, generating DirectVolumeAccess hits
Active Directory operations teams running ntdsutil.exe for authorized domain controller IFM creation, NTDS database integrity checks, or offline defragmentation — the command-line signature is identical to attacker use and requires out-of-band context (change tickets, known admin accounts) to differentiate

Sigma rule & cross-platform mapping

The detection logic for Direct Volume Access (T1006) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1006 Sigma rules on detection.fyi

Platform-specific guides for T1006

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-13 Research depth: deep

References (10)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1VSS Shadow Copy Creation and NTDS Extraction via esentutl
Expected signal: Sysmon Event ID 1: Process Create for vssadmin.exe with CommandLine containing 'create shadow /for=C:'. Second Sysmon Event ID 1: esentutl.exe with CommandLine containing the \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy path and '/vss'. Security Event ID 4688 for both processes if command line auditing is enabled. Microsoft-Windows-StorageService/Operational events for VSS snapshot creation. Sysmon Event ID 11 (File Create) for SYSTEM.bak in %TEMP%.
Test 2Diskshadow Script-Based Shadow Copy and File Exposure
Expected signal: Sysmon Event ID 1: diskshadow.exe with CommandLine containing '/s' and the .dsh script path. Sysmon Event ID 11: creation of dsh_test.dsh in %TEMP% by powershell.exe. Security Event ID 4688 for diskshadow.exe. Microsoft-Windows-StorageService/Operational events for VSS snapshot creation via diskshadow. If drive Z: is exposed, subsequent file access on Z: generates normal file system events attributed to the accessing process.
Test 3ntdsutil IFM Media Creation for NTDS Extraction
Expected signal: Sysmon Event ID 1: ntdsutil.exe with CommandLine containing 'ifm', 'create full', and the output path. Security Event ID 4688 for ntdsutil.exe. On a domain controller: Security Event ID 4656/4663 for NTDS directory handle access, and Sysmon Event ID 11 for file creation of ntds.dit and SYSTEM in the IFM output directory. On a non-DC: ntdsutil exits with an error (0x80070003 - path not found for NTDS) but process creation event still fires.
Test 4PowerShell Direct Physical Drive Read Simulation
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing '\\.\PhysicalDrive0' and 'FileOpen'. Security Event ID 4688 if command line auditing is enabled. If Object Access auditing covers raw disk handles: Security Event ID 4656 for handle request to PhysicalDrive0. This command will fail with 'Access Denied' for non-elevated users, but the process creation event still fires and matches the detection pattern.

Response Playbook

Triage

Identify the tool and command used — vssadmin, esentutl, diskshadow, ntdsutil IFM, wbadmin, or PowerShell NinjaCopy. Each has different typical usage patterns: esentutl /y with a GLOBALROOT path is almost never legitimate outside a forensics or backup context.
Check the parent process — was the volume access tool launched by a user interactively (explorer.exe, cmd.exe from a logon session), a scheduled task (taskeng.exe, svchost.exe), or a remote access tool? Interactive execution by a non-admin on a domain controller is a critical escalation trigger.
Identify the target of the volume access — does the command reference ntds.dit, SYSTEM, SAM, or SECURITY hive? These are credential stores. Any shadow copy access targeting these files warrants immediate escalation regardless of context.
Verify the user account — is this a domain admin, backup service account, or standard user? Check whether the account has a legitimate operational reason (scheduled backup job, DBA activity). Cross-reference with Active Directory group membership and recent logon events (Event ID 4624).
Check the host role — is this a domain controller, file server, or workstation? Shadow copy operations on domain controllers targeting NTDS are extremely high severity. The same operation on a file server during a backup window may be routine.
Correlate with recent events on the same host — look for preceding reconnaissance commands (nltest, net group, dsquery), lateral movement (PsExec, WMI, RDP), or privilege escalation in the 30-60 minutes before this event. Volume access is often a late-stage technique.
For esentutl commands: decode the full source and destination paths in the /y flag arguments. A path like /y \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit /vss is unambiguously malicious.
For diskshadow: examine the full script if a script file was passed. Attackers frequently use diskshadow with a pre-written .dsh script to automate shadow creation and exposure while evading simple command-line detections.

Containment

If ntds.dit or credential hive access confirmed: treat as full domain compromise. Immediately escalate to the incident response team lead and initiate the domain compromise runbook — this requires a full forest password reset including krbtgt (twice, 10 hours apart) and all privileged accounts.
Isolate the host from the network using EDR network isolation or emergency VLAN change to prevent exfiltration of any files already copied. Check DeviceNetworkEvents or Sysmon Event ID 3 for outbound connections in the minutes following the volume access.
Disable the account that performed the action in Active Directory — revoke all Kerberos tickets with a password reset (which invalidates existing TGTs) and terminate any active sessions via Event ID 4647 and logoff enforcement.
Preserve the VSS shadow copies on the affected host before remediation — do NOT delete them, as they are forensic evidence. Document the shadow copy GUIDs with: vssadmin list shadows /for=C:
If a file was successfully exfiltrated (check file creation events and network events), block the destination IP/domain at the perimeter firewall and proxy and initiate threat intelligence lookup.
For domain controllers: verify ntds.dit integrity on all DCs using repadmin /showrepl and check for unauthorized AD object changes using Get-ADObject with -IncludeDeletedObjects in the past 24 hours.

Evidence Collection

Process creation logs — Sysmon Event ID 1 or Security Event ID 4688 (requires 'Audit Process Creation' and 'Include command line in process creation events' GPO): capture the full command line with all arguments for the volume access tool.
File creation and access events — Sysmon Event ID 11 (File Created) for any output files written by esentutl or diskshadow. Check for new .dit, .bak, or archive files created in temp directories or unusual paths.
VSS audit events — Windows Event Log: Microsoft-Windows-StorageService/Operational and Microsoft-Windows-VolumeSnapshot-Driver/Operational contain VSS snapshot creation and deletion records with timestamps and requestor process.
Security Event ID 4656/4663 — Object Access auditing for file and directory handles. If enabled, these show direct file system object access and are crucial for confirming ntds.dit was read.
Security Event ID 4698/4702 — Scheduled Task creation or modification: adversaries may create a task to run volume access tools under a privileged account context.
PowerShell ScriptBlock Logging (Event ID 4104) — if NinjaCopy or custom PowerShell volume access scripts were used, this log contains the full deobfuscated script content including all parameters.
Network forensics — capture and preserve pcap or flow records from the host's network interface during the incident window, particularly any large outbound data transfers following the volume access event.
MFT ($MFT) and USN Journal — use tools like MFTECmd or analyzeMFT to identify recently created files on the host that may represent the exfiltrated credential stores. The USN journal contains a detailed record of file system changes.

Escalation Criteria

! Any command directly targeting ntds.dit, SYSTEM, or SAM hive via shadow copy or direct volume path — treat as credential theft in progress regardless of whether the copy succeeded.
! esentutl or diskshadow execution on a domain controller by any account other than the designated backup service account with a current change ticket.
! PowerShell invoking NinjaCopy or direct physical drive access — this is a known offensive tool pattern with no common administrative use case.
! Shadow copy creation immediately followed (within minutes) by a large file copy operation or outbound network transfer — indicates complete extract-and-exfiltrate sequence.
! Volume access tool launched by a process that itself was spawned by a remote execution framework (PsExec parent, WmiPrvSE.exe parent, mstsc.exe session) — indicates active hands-on-keyboard attacker.
! Multiple domain controllers showing shadow copy creation events within the same time window — indicates automated lateral movement or a worm-like propagation pattern.

Investigation Guide

Forensic Artifacts

> Registry: HKLM\SYSTEM\CurrentControlSet\Services\VSS — VSS service configuration and provider registration; check LastModified time for recent changes
> Event Log: Microsoft-Windows-StorageService/Operational — records VSS snapshot creation requests with requesting process PID and timestamp
> Event Log: Microsoft-Windows-VolumeSnapshot-Driver/Operational — low-level VSS driver events including shadow copy creation and deletion
> File System: C:\Windows\System32\winevt\Logs\ — check for recently modified or cleared event log files; Event ID 1102 indicates log clearing
> File System: %TEMP%, %APPDATA%, C:\Windows\Temp — common staging locations for files copied via esentutl or diskshadow before exfiltration
> Prefetch: C:\Windows\Prefetch\ESENTUTL.EXE-*.pf, VSSADMIN.EXE-*.pf, DISKSHADOW.EXE-*.pf — execution timestamps and referenced DLLs/files
> Volume Shadow Copies: Run 'vssadmin list shadows /for=C:' to enumerate existing shadows and their creation times; compare against known backup schedules
> Windows Backup Database: C:\Windows\System32\wbem\Repository — contains WMI VSS provider state; also check C:\WindowsImageBackup for wbadmin artifacts
> MFT and USN Journal: Use MFTECmd to identify file creation timestamps around the incident window, particularly for .dit files or large binary files in temp locations
> Security Event ID 4656/4663 — if Object Access auditing is enabled for C:\Windows\NTDS\, these events record NTDS directory handle access with the requesting process

Tuning Guidance

The primary source of false positives is legitimate backup infrastructure. Before deploying, inventory all backup agents, software, and service accounts in your environment: Veeam (typically runs as SYSTEM or a dedicated service account and spawns vssvc.exe), Windows Server Backup (uses wbadmin.exe with predictable schedules), and Acronis or similar agents. Build allowlist entries based on specific service account + parent process combinations rather than tool name alone — never exclude vssadmin.exe globally. For domain controllers specifically, the detection threshold should be zero tolerance: any interactive or scheduled task execution of esentutl, diskshadow, or ntdsutil IFM on a DC outside of a documented backup window should immediately alert. In environments where ntdsutil IFM is used for legitimate DC promotion (creating IFM media for new DC installs), validate against Active Directory site topology changes. For the PowerShell NinjaCopy branch, false positives are rare — this is an offensive-only tool. For the direct volume path detection, tune by excluding known backup tool executables in the InitiatingProcessFileName field rather than by command line patterns. Enable Windows Object Access auditing for the C:\Windows\NTDS directory on all domain controllers (Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy > Object Access > Audit File System) to get Event ID 4663 records that independently confirm file access.

Hunting Queries

Hunt for file creation events referencing shadow copy device paths or credential store filenames. This captures the file system artifact of a successful extraction — when esentutl or a custom tool writes the copied credential file to a staging location. Excludes legitimate VSS service processes to reduce false positives.

Hunting — KQL

kql

DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("HarddiskVolumeShadowCopy", "GLOBALROOT\\Device", "\\\\.\\")
   or FileName in~ ("ntds.dit", "ntds.jfm", "SAM", "SECURITY", "SYSTEM")
| where not (InitiatingProcessFileName in~ ("vssvc.exe", "WmiPrvSE.exe", "svchost.exe"))
| summarize
    AccessCount = count(),
    UniqueFiles = make_set(FileName),
    Paths = make_set(FolderPath),
    Processes = make_set(InitiatingProcessFileName)
    by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where AccessCount > 0
| sort by AccessCount desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*HarddiskVolumeShadowCopy*" OR TargetFilename="*GLOBALROOT*"
   OR TargetFilename="*ntds.dit*" OR TargetFilename="*\\SAM" OR TargetFilename="*\\SECURITY"
   OR TargetFilename="*\\SYSTEM")
  NOT (Image="*\\vssvc.exe" OR Image="*\\WmiPrvSE.exe" OR Image="*\\svchost.exe")
| stats count as FileEvents, values(TargetFilename) as Files, dc(TargetFilename) as UniqueFiles
    by host, User, Image, ParentImage
| sort - FileEvents

Hunt for the attack sequence: shadow copy creation (vssadmin create shadow) followed within 30 minutes by a file copy tool (esentutl, robocopy, PowerShell) referencing the shadow copy device path or credential file names. This temporal correlation catches multi-step credential extraction chains that individual command detections might miss.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "vssadmin.exe"
| where ProcessCommandLine has "create shadow"
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where FileName in~ ("esentutl.exe", "robocopy.exe", "xcopy.exe", "powershell.exe")
    | where ProcessCommandLine has_any ("HarddiskVolumeShadowCopy", "GLOBALROOT", "ntds", "SAM", "SYSTEM")
    | project JoinTimestamp = Timestamp, DeviceName, FollowOnTool = FileName,
              FollowOnCmdLine = ProcessCommandLine, AccountName
  ) on DeviceName
| where JoinTimestamp between (Timestamp .. (Timestamp + 30min))
| project ShadowCreateTime = Timestamp, DeviceName, AccountName, ProcessCommandLine,
          FollowOnTool, FollowOnCmdLine, JoinTimestamp
| sort by ShadowCreateTime desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\vssadmin.exe" CommandLine="*create shadow*"
| rename _time as ShadowCreateTime, host as TargetHost
| join type=inner TargetHost [
    search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (Image="*\\esentutl.exe" OR Image="*\\robocopy.exe" OR Image="*\\powershell.exe")
      (CommandLine="*HarddiskVolumeShadowCopy*" OR CommandLine="*GLOBALROOT*" OR CommandLine="*ntds*")
    | rename host as TargetHost, _time as FollowOnTime, Image as FollowOnTool, CommandLine as FollowOnCmd
    | table TargetHost, FollowOnTime, FollowOnTool, FollowOnCmd
  ]
| where (FollowOnTime - ShadowCreateTime) >= 0 AND (FollowOnTime - ShadowCreateTime) <= 1800
| table ShadowCreateTime, TargetHost, User, CommandLine, FollowOnTime, FollowOnTool, FollowOnCmd
| sort - ShadowCreateTime

Hunt specifically for esentutl invocations where the /y (source) argument resolves to a VSS shadow copy device path or credential store name. Extracts source and destination paths from the command line to make the intent immediately visible without manual log parsing. This technique is a hallmark of the Scattered Spider, Volt Typhoon, and many ransomware group TTPs.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "esentutl.exe"
| extend SourcePath = extract(@"/y\s+([^\s]+)", 1, ProcessCommandLine)
| extend DestPath = extract(@"/d\s+([^\s]+)", 1, ProcessCommandLine)
| extend IsVSSSource = SourcePath has_any ("HarddiskVolumeShadowCopy", "GLOBALROOT", "PhysicalDrive")
| extend IsCredentialTarget = SourcePath has_any ("ntds.dit", "SAM", "SECURITY", "SYSTEM", "NTDS")
| where IsVSSSource or IsCredentialTarget
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
          SourcePath, DestPath, IsVSSSource, IsCredentialTarget,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\esentutl.exe"
| rex field=CommandLine "/y\s+(?P<SourcePath>\S+)"
| rex field=CommandLine "/d\s+(?P<DestPath>\S+)"
| eval IsVSSSource=if(match(SourcePath, "(HarddiskVolumeShadowCopy|GLOBALROOT|PhysicalDrive)"), 1, 0)
| eval IsCredentialTarget=if(match(lower(SourcePath), "(ntds\.dit|\bsam\b|\bsecurity\b|\bsystem\b|ntds)"), 1, 0)
| where IsVSSSource=1 OR IsCredentialTarget=1
| table _time, host, User, CommandLine, SourcePath, DestPath, IsVSSSource, IsCredentialTarget, ParentImage
| sort - _time

Atomic Red Team Tests

Test 1 VSS Shadow Copy Creation and NTDS Extraction via esentutl

windows

Simulates the Scattered Spider and Volt Typhoon TTP: creates a Volume Shadow Copy of the C: drive using vssadmin, then uses esentutl to copy a file from the shadow copy path. On a non-domain-controller, substitutes a benign system file (ntds.dit substitute). This is the most common real-world credential extraction sequence and should trigger both the shadow copy creation detection and the esentutl VSS path detection.

Command

powershell

vssadmin create shadow /for=C: 2>&1 | Tee-Object -Variable vssOutput; $shadowId = ($vssOutput | Select-String 'Shadow Copy Volume Name:').ToString().Split(':',2)[1].Trim(); Write-Host "Shadow path: $shadowId"; esentutl.exe /y "${shadowId}\Windows\System32\config\SYSTEM" /d "$env:TEMP\SYSTEM.bak" /vss

Cleanup

powershell

Remove-Item "$env:TEMP\SYSTEM.bak" -ErrorAction SilentlyContinue; vssadmin delete shadows /for=C: /quiet 2>$null

Expected Telemetry

Sysmon Event ID 1: Process Create for vssadmin.exe with CommandLine containing 'create shadow /for=C:'. Second Sysmon Event ID 1: esentutl.exe with CommandLine containing the \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy path and '/vss'. Security Event ID 4688 for both processes if command line auditing is enabled. Microsoft-Windows-StorageService/Operational events for VSS snapshot creation. Sysmon Event ID 11 (File Create) for SYSTEM.bak in %TEMP%.

Expected Detection

Branch 1 (ShadowCopyOrVSSToolUsage) fires on vssadmin create shadow. Branch 2 (EsentutlVSS in SPL, DirectVolumePathInCommandLine in KQL) fires on esentutl with GLOBALROOT path. File creation event for SYSTEM.bak triggers if DeviceFileEvents branch is active. RiskScore: Critical if SYSTEM is matched in CredentialTargets.

Test 2 Diskshadow Script-Based Shadow Copy and File Exposure

windows

Uses diskshadow.exe with a script file to create a shadow copy and expose it as a drive letter — the technique documented in multiple ransomware and APT playbooks. Diskshadow accepts a script file that automates the multi-step process attackers use to avoid interactive command-line exposure. The exposed shadow drive is then accessible for direct file reads bypassing ACLs.

Command

powershell

$script = @"
set context persistent nowriters
add volume c: alias dftest
create
expose %dftest% z:
"@; $script | Out-File -Encoding ASCII "$env:TEMP\dsh_test.dsh"; diskshadow.exe /s "$env:TEMP\dsh_test.dsh"; Start-Sleep 3; if (Test-Path 'Z:\Windows\System32\config\SAM') { Write-Host 'SAM accessible via shadow at Z:\Windows\System32\config\SAM' }

Cleanup

powershell

diskshadow.exe /s { unexpose z: } 2>$null; vssadmin delete shadows /for=C: /quiet 2>$null; Remove-Item "$env:TEMP\dsh_test.dsh" -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: diskshadow.exe with CommandLine containing '/s' and the .dsh script path. Sysmon Event ID 11: creation of dsh_test.dsh in %TEMP% by powershell.exe. Security Event ID 4688 for diskshadow.exe. Microsoft-Windows-StorageService/Operational events for VSS snapshot creation via diskshadow. If drive Z: is exposed, subsequent file access on Z: generates normal file system events attributed to the accessing process.

Expected Detection

SPL and KQL both detect diskshadow.exe execution (ToolCategory=DiskShadow / DetectionBranch=ShadowCopyOrVSSToolUsage). PowerShell creating the .dsh script file may additionally trigger T1059.001 detections. The exposed drive access does not directly generate VSS-path events but follow-on file reads from Z:\Windows\System32\config\ are detectable via file monitoring.

Test 3 ntdsutil IFM Media Creation for NTDS Extraction

windows

Uses ntdsutil in IFM (Install From Media) mode — a legitimate Active Directory tool for creating installation media for new domain controllers. Attackers abuse this built-in mechanism to dump the NTDS database and SYSTEM hive into a folder, bypassing direct file access restrictions. On a non-DC, ntdsutil IFM will fail with an error but still generates the expected process creation telemetry. Run on a test DC for full telemetry.

Command

powershell

ntdsutil.exe "ac i ntds" "ifm" "create full $env:TEMP\ntdsutil_ifm_test" q q

Cleanup

powershell

Remove-Item "$env:TEMP\ntdsutil_ifm_test" -Recurse -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: ntdsutil.exe with CommandLine containing 'ifm', 'create full', and the output path. Security Event ID 4688 for ntdsutil.exe. On a domain controller: Security Event ID 4656/4663 for NTDS directory handle access, and Sysmon Event ID 11 for file creation of ntds.dit and SYSTEM in the IFM output directory. On a non-DC: ntdsutil exits with an error (0x80070003 - path not found for NTDS) but process creation event still fires.

Expected Detection

SPL ToolCategory=NtdsutilIFM fires immediately. KQL DetectionBranch=ShadowCopyOrVSSToolUsage fires on ntdsutil with 'ifm' in command line. TargetsCredentials=1 if 'ntds' appears in the output path argument. On a DC, the file creation of ntds.dit sets RiskScore=Critical.

Test 4 PowerShell Direct Physical Drive Read Simulation

windows

Simulates the NinjaCopy technique by opening a direct handle to the physical drive using .NET File I/O — the same underlying mechanism used by Invoke-NinjaCopy from PowerSploit. This bypasses NTFS file locking by reading sectors directly from the physical disk. On standard endpoints, this requires elevated privileges. The command opens \\.\ PhysicalDrive0 for raw reading, which generates the expected process-to-device telemetry.

Command

powershell

powershell.exe -NoProfile -Command "$fs = [System.IO.File]::Open('\\\\.\\PhysicalDrive0', [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::ReadWrite); $buf = New-Object byte[] 512; $read = $fs.Read($buf, 0, 512); Write-Host "MBR signature bytes: $($buf[510].ToString('X2')) $($buf[511].ToString('X2'))"; $fs.Close()"

Expected Telemetry

Sysmon Event ID 1: powershell.exe with CommandLine containing '\\.\PhysicalDrive0' and 'FileOpen'. Security Event ID 4688 if command line auditing is enabled. If Object Access auditing covers raw disk handles: Security Event ID 4656 for handle request to PhysicalDrive0. This command will fail with 'Access Denied' for non-elevated users, but the process creation event still fires and matches the detection pattern.

Expected Detection

KQL branch PowerShellDirectVolumeAccess fires on 'PhysicalDrive' in the PowerShell command line. SPL query matches on CommandLine containing '\\.\PhysicalDrive'. DetectionBranch=PowerShellDirectVolumeAccess. RiskScore=High. Alert text should note that elevation check (SYSTEM or admin account) is an additional severity indicator.

What is T1006 Direct Volume Access?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1006

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox