Identifier / Programs / Windows

diskshadow.exe

Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). Windows commands reference

LOLBAS Dump, Execute 4 Sigma rules name it 3 ATT&CK techniques 2 documented commands 6 known copies with hashes

How diskshadow.exe is abused

documented by LOLBAS

Dump T1003.003 OS Credential Dumping: NTDS

-s

Execute T1202 Indirect Command Execution

exec

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for diskshadow.exe.

2 documented commands

from LOLBAS, each read by the identifier

Dump T1003.003 OS Credential Dumping: NTDS User privileges

Execute commands using diskshadow.exe from a prepared diskshadow script.

diskshadow.exe /s {PATH:.txt}

Identify

Trips 1 Sigma rule: mediumDiskshadow Script Mode Execution by Ivan Dyachkov, oscd.community

Execute T1202 Indirect Command Execution User privileges

Execute commands using diskshadow.exe to spawn child process

diskshadow> exec {PATH:.exe}

Identify

Trips no Sigma process-creation rule.

1 of the 2 commands the identifier reads trips a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for diskshadow.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for diskshadow.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumDiskshadow Script Mode ExecutionIvan Dyachkov, oscd.community

mediumDiskshadow Script Mode - Uncommon Script Extension ExecutionNasreddine Bencherchali (Nextron Systems)

mediumDiskshadow Script Mode - Execution From Potential Suspicious LocationNasreddine Bencherchali (Nextron Systems)

highShadow Copies Deletion Using Operating Systems UtilitiesFlorian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)

T1003.003OS Credential Dumping: NTDS

T1202Indirect Command Execution

T1218System Binary Proxy Execution

Is it the real diskshadow.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionDiskShadow

6 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\diskshadow.exe · signed by Microsoft Windows

4dc14fad188adad5f06442f40c1698362ba0c7fa585b108aedcdc792921df233

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\diskshadow.exe · signed by Microsoft Windows

7d08b3b10f1918135c0270bb0cf1ced0927ef61e7348e908ccae8ca00132f0d8

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\diskshadow.exe · signed by Microsoft Windows

8d556f8ca5588872ab80ee7dcf93b0eee4cd2596a454cc7ade4ea7ced3f8d7d8

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\diskshadow.exe · signed by Microsoft Windows

8f952634c1cd9a06e286af1d55d52f06a4b1c316568a11eca1b5a9aff3c043f9

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\diskshadow.exe · not signed

a3bb39a8e9ac6177ca65a54279049b12666a8631a995ecc79a59be1d4e539c85

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\diskshadow.exe · not signed

e10ce1898a2817acd53eb35eb097e8b4043684ca768b45686e6aa6ebe2f674a8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.