Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere

Hunt Hypothesis

This detection identifies adversaries executing the VSSown.vbs script to leverage Volume Shadow Copy (VSC) for exporting critical data artifacts, such as the NTDS.dit file, enabling offline password cracking and credential theft. A proactive hunt is essential in Azure Sentinel because this technique allows attackers to silently extract sensitive credentials from shadow copies before they can be detected by standard real-time monitoring tools.

YARA Rule

rule VSSown_VBS {
	meta:
		description = "Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere"
		author = "Florian Roth"
		date = "2015-10-01"
		score = 75
	strings:
		$s0 = "Select * from Win32_Service Where Name ='VSS'" ascii
		$s1 = "Select * From Win32_ShadowCopy" ascii
		$s2 = "cmd /C mklink /D " ascii
		$s3 = "ClientAccessible" ascii
		$s4 = "WScript.Shell" ascii
		$s5 = "Win32_Process" ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the VSSown.vbs detection rule, including suggested filters or exclusions:

• Scenario: Scheduled Backup Job on Domain Controllers

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Commvault often utilize a scheduled task to run cscript.exe with the VSSown.vbs script during off-hours (e.g., 02:00 AM) on Domain Controllers. This is done specifically to capture the Active Directory database (NTDS.dit) in a consistent state for offline cracking or archival.
  • Filter/Exclusion: Create an exclusion rule that ignores alerts where the parent process is vssvc.exe (Volume Shadow Copy Service) or specific backup agents like VeeamTransportService.exe, and the script path matches the known backup installation directory (e.g., C:\Program Files\Veeam\Backup and Replication\...).

• Scenario: Automated Forensic Data Collection by Security Operations

  • Context: The SOC team may have a recurring automated playbook using tools like PowerShell or Ansible that triggers the VSSown.vbs script to extract shadow copies of critical files (such as SAM, SYSVOL, and NTDS) for weekly forensic analysis. This is often triggered by a scheduled job in Windows Task Scheduler named “Weekly AD Snapshot”.
  • Filter/Exclusion: Filter alerts based on the User Account executing the script. If the process runs under a dedicated service account (e.g., DOMAIN\svc-backup or DOMAIN\svc-forensics) rather than an interactive user, suppress the alert. Additionally, exclude paths where the script resides in a known security tool directory like C:\Program Files\SOC_Tools\Scripts.