{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Attacker tradecraft often relies on legitimate tools (VSS, PsExec, qwinsta) that are used by administrators. A negative result confirms that these tools are operating within baseline norms across your high-risk assets, which is a critical signal for defensive posture." }, "name": "VSS Abuse Precursors: Exploitation and Lateral Movement", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1021.002", "attack.t1021.001", "attack.t1018", "attack.t1003.002" ], "series": { "slug": "how-attackers-abuse-vss-and-how-huntress-detects-it", "index": 1, "title": "How Attackers Abuse VSS, and How Huntress Detects It", "total": 2 }, "related": [ { "hunt": "vss-manipulation-and-ntds-theft", "reason": "This hunt identifies the early movement; the follow-on hunt focuses specifically on the VSS creation/deletion and the theft of the ntds.dit file.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single detection rule for PsExec often relies on the presence of a specific service name or file hash, both of which are trivial to change. This hunt looks for the underlying behavior (shells from services.exe) and contextualizes it with both vulnerability exposure and rarity (prevalence) across the fleet.", "coverage": [ { "stage": "initial-exploitation", "steps": [ "scoping-vulnerable-targets" ], "status": "covered" }, { "stage": "lateral-movement-psexec", "steps": [ "psexec-shell-spawn" ], "status": "covered" }, { "stage": "internal-reconnaissance", "steps": [ "rare-discovery-tools", "dns-enumeration-lookups" ], "status": "covered" }, { "stage": "vss-credential-access", "reason": "Belongs to another part of the 'How Attackers Abuse VSS, and How Huntress Detects It' series.", "status": "out_of_scope" }, { "stage": "vss-recovery-inhibition", "reason": "Belongs to another part of the 'How Attackers Abuse VSS, and How Huntress Detects It' series.", "status": "out_of_scope" }, { "stage": "ransomware-encryption", "reason": "Belongs to another part of the 'How Attackers Abuse VSS, and How Huntress Detects It' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Exploitation of Public-Facing Application", "slug": "initial-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Exploitation of internet-facing host", "Vulnerability exploitation in web servers or databases" ] }, { "name": "Lateral Movement via SMB and PsExec", "slug": "lateral-movement-psexec", "tactic": "lateral-movement", "techniques": [ "T1021.002" ], "observables": [ "PsExec usage", "Spawning of SYSTEM-level command shell processes", "Activity on domain controllers" ] }, { "name": "Session and Network Reconnaissance", "slug": "internal-reconnaissance", "tactic": "discovery", "techniques": [ "T1021.001" ], "observables": [ "Enumeration of active Remote Desktop sessions", "DNS enumeration commands", "Reconnaissance against additional network hosts" ] }, { "name": "Credential Access via Shadow Copy", "slug": "vss-credential-access", "tactic": "credential-access", "techniques": [ "T1490" ], "observables": [ "vssadmin create shadow", "Extraction of ntds.dit from volume shadow copy" ] }, { "name": "Inhibit System Recovery via Shadow Deletion", "slug": "vss-recovery-inhibition", "tactic": "impact", "techniques": [ "T1490" ], "observables": [ "vssadmin delete shadows /all /quiet", "Deletion of shadow copies following credential extraction" ] }, { "name": "Data Encrypted for Impact", "slug": "ransomware-encryption", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "Mass file encryption", "Ransomware detonation" ] } ], "summary": "Attackers leverage Volume Shadow Copy (VSS) to facilitate credential theft by creating shadows to extract the NTDS.dit database or to inhibit recovery by deleting shadows prior to ransomware deployment. These techniques are often preceded by lateral movement using tools like PsExec and internal reconnaissance against domain controllers." }, "severity": "medium", "rationale": "Start by identifying hosts with critical vulnerabilities (severity_id >= 4) that haven't been remediated. These hosts are the most likely entry points and should be prioritized in the scope_hosts parameter if the fleet-wide results are too noisy.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker is moving laterally from a compromised internet-facing asset to locate high-value targets for VSS-based credential theft or ransomware deployment.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Target specific hosts identified in the scoping step; leave empty for fleet-wide." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "recon_utilities": { "from": { "ref": "huntress-vss-abuse", "kind": "article", "observed": "2026-09-14" }, "type": "list[string]", "default": [ "qwinsta.exe", "rwinsta.exe", "query.exe", "nslookup.exe", "dnscmd.exe" ], "description": "Administrative tools used for session enumeration and network discovery." }, "psexec_indicators": { "from": { "ref": "sysinternals-indicators", "kind": "manual", "observed": "2024-05-22" }, "type": "list[string]", "default": [ "psexesvc.exe", "psexec.exe", "psexec64.exe" ], "description": "Binary names associated with PsExec or similar remote execution tools." }, "shell_interpreters": { "type": "list[string]", "default": [ "cmd.exe", "powershell.exe", "pwsh.exe" ], "description": "Common command shell interpreters." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/vss-abuse-explained", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/vss-abuse-explained", "name": "How Attackers Abuse VSS, and How Huntress Detects It" } ], "blind_spots": [ { "id": "no-process-logs", "risk": "A host without active process monitoring allows service-spawned shells to run entirely unobserved.", "stage": "lateral-movement-psexec", "question": "Was a shell spawned that we missed due to agent configuration?", "requires": "hb_process_activity from a full endpoint agent (osquery/sysmon)" }, { "id": "ephemeral-dns-recon", "risk": "If DNS logs are not retained or if the attacker used a local resolver cache that was flushed, the reconnaissance phase will be invisible.", "stage": "internal-reconnaissance", "question": "Did the attacker use DNS records to find DCs before the hunt window?", "requires": "hb_dns_activity from a network tap or full local agent" } ] }, "name": "VSS Abuse Precursors: Exploitation and Lateral Movement", "description": "This hunt focuses on the early precursors of Volume Shadow Copy Service (VSS) abuse as researched by Huntress. It targets the initial transition from a web-based exploit to internal movement. By identifying vulnerable hosts, looking for the specific signature of PsExec-style remote execution (shells spawned by the Service Control Manager), and stack-counting the use of session enumeration tools, we identify attackers before they reach the destructive phase of deleting shadows or dumping Active Directory secrets. The hunt correlates these behaviors to distinguish an active breach from routine administrative disk hygiene." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "how-attackers-abuse-vss-and-how-huntress-detects-it", "index": 1, "title": "How Attackers Abuse VSS, and How Huntress Detects It", "total": 2 }, "coverage": [ { "stage": "initial-exploitation", "steps": [ "scoping-vulnerable-targets" ], "status": "covered" }, { "stage": "lateral-movement-psexec", "steps": [ "psexec-shell-spawn" ], "status": "covered" }, { "stage": "internal-reconnaissance", "steps": [ "rare-discovery-tools", "dns-enumeration-lookups" ], "status": "covered" }, { "stage": "vss-credential-access", "reason": "Belongs to another part of the 'How Attackers Abuse VSS, and How Huntress Detects It' series.", "status": "out_of_scope" }, { "stage": "vss-recovery-inhibition", "reason": "Belongs to another part of the 'How Attackers Abuse VSS, and How Huntress Detects It' series.", "status": "out_of_scope" }, { "stage": "ransomware-encryption", "reason": "Belongs to another part of the 'How Attackers Abuse VSS, and How Huntress Detects It' series.", "status": "out_of_scope" } ], "rationale": "An attacker is moving laterally from a compromised internet-facing asset to locate high-value targets for VSS-based credential theft or ransomware deployment.", "blind_spots": [ { "id": "no-process-logs", "risk": "A host without active process monitoring allows service-spawned shells to run entirely unobserved.", "stage": "lateral-movement-psexec", "question": "Was a shell spawned that we missed due to agent configuration?", "requires": "hb_process_activity from a full endpoint agent (osquery/sysmon)" }, { "id": "ephemeral-dns-recon", "risk": "If DNS logs are not retained or if the attacker used a local resolver cache that was flushed, the reconnaissance phase will be invisible.", "stage": "internal-reconnaissance", "question": "Did the attacker use DNS records to find DCs before the hunt window?", "requires": "hb_dns_activity from a network tap or full local agent" } ], "scoping_notes": "Start by identifying hosts with critical vulnerabilities (severity_id >= 4) that haven't been remediated. These hosts are the most likely entry points and should be prioritized in the scope_hosts parameter if the fleet-wide results are too noisy.", "beyond_detection": "A single detection rule for PsExec often relies on the presence of a specific service name or file hash, both of which are trivial to change. This hunt looks for the underlying behavior (shells from services.exe) and contextualizes it with both vulnerability exposure and rarity (prevalence) across the fleet." } }, { "id": "scoping-vulnerable-targets", "type": "query", "label": "Identify High-Risk Vulnerable Assets", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_uid, cve_uid, severity, affected_package_name, first_seen FROM hb_vulnerability_finding WHERE severity_id >= 4 AND status != 'suppressed' AND resource_type = 'device'", "surface": "hb_vulnerability_finding", "description": "Locate hosts with critical vulnerabilities that could serve as initial beachheads for an intrusion.", "expected_signal": "A list of hosts with unpatched high/critical vulnerabilities. Use these in the scope_hosts parameter for subsequent steps." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify High-Risk Vulnerable Assets", "reads": [ "device_uid", "cve_uid", "severity", "affected_package_name", "first_seen" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, cve_uid, severity, affected_package_name, first_seen FROM hb_vulnerability_finding WHERE severity_id >= 4 AND status != 'suppressed' AND resource_type = 'device'", "silence": "not_evidence_of_absence", "expected": "A list of hosts with unpatched high/critical vulnerabilities. Use these in the scope_hosts parameter for subsequent steps.", "verified": "dry-run", "verified_at": "2026-09-17" } }, { "id": "psexec-shell-spawn", "type": "query", "label": "Shells Spawned via Service Control Manager", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{psexec_indicators}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR (LOWER(parent_process_name) LIKE '%\\\\services.exe' AND instr(',' || '{{shell_interpreters}}' || ',', ',' || LOWER(process_name) || ',') > 0)) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect the most common signature of remote administrative execution (PsExec) by identifying shells running as children of services.exe.", "expected_signal": "A shell like cmd.exe running as a child of services.exe on a host with critical vulnerabilities. This is a high-confidence indicator of lateral movement." }, "parents": [ { "id": "scoping-vulnerable-targets" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Shells Spawned via Service Control Manager", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{psexec_indicators}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR (LOWER(parent_process_name) LIKE '%\\\\services.exe' AND instr(',' || '{{shell_interpreters}}' || ',', ',' || LOWER(process_name) || ',') > 0)) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A shell like cmd.exe running as a child of services.exe on a host with critical vulnerabilities. This is a high-confidence indicator of lateral movement.", "verified": "dry-run", "verified_at": "2026-09-17" } }, { "id": "rare-discovery-tools", "type": "query", "label": "Rare Session and Network Recon Tool Usage", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS tool, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE instr(',' || '{{recon_utilities}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY tool HAVING host_count <= 3 ORDER BY host_count ASC", "surface": "hb_process_activity", "description": "Stack-count administrative tools that are uncommon across the fleet, identifying manual environment exploration.", "expected_signal": "Utilities like 'qwinsta' (session query) appearing on only one or two hosts, especially if those hosts are within the vulnerable scope." }, "parents": [ { "id": "scoping-vulnerable-targets" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare Session and Network Recon Tool Usage", "reads": [ "process_name", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS tool, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE instr(',' || '{{recon_utilities}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY tool HAVING host_count <= 3 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Utilities like 'qwinsta' (session query) appearing on only one or two hosts, especially if those hosts are within the vulnerable scope.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "tool" ], "rare_below": 3 }, "verified_at": "2026-09-17" } }, { "id": "dns-enumeration-lookups", "type": "query", "label": "Internal Domain Reconnaissance via DNS", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE (LOWER(query_hostname) LIKE '%_ldap._tcp.%' OR LOWER(query_hostname) LIKE '%_kerberos._tcp.%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "surface": "hb_dns_activity", "description": "Identify hosts querying for Active Directory infrastructure, indicating reconnaissance prior to credential theft.", "expected_signal": "Any host querying for service records to locate domain controllers, which is a required step for VSS-based NTDS.dit theft." }, "parents": [ { "id": "scoping-vulnerable-targets" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Internal Domain Reconnaissance via DNS", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE (LOWER(query_hostname) LIKE '%_ldap._tcp.%' OR LOWER(query_hostname) LIKE '%_kerberos._tcp.%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "silence": "not_evidence_of_absence", "expected": "Any host querying for service records to locate domain controllers, which is a required step for VSS-based NTDS.dit theft.", "verified": "dry-run", "verified_at": "2026-09-17" } }, { "id": "triage-precursors", "type": "analytic", "label": "Synthesize Breach Evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "scoping-vulnerable-targets", "psexec-shell-spawn", "rare-discovery-tools", "dns-enumeration-lookups" ], "objective": "Determine if any host identified as vulnerable is also exhibiting signs of lateral movement via PsExec or manual environment reconnaissance.", "description": "Correlate vulnerability scope with the behavioral results from the parallel branches.", "max_iterations": 3, "expected_signal": "A verdict for each host in the context.", "success_criteria": "A verdict of malicious | suspicious | benign citing the intersection of vulnerability data and behavioral rows." }, "parents": [ { "id": "psexec-shell-spawn", "kind": "merge" }, { "id": "rare-discovery-tools", "kind": "merge" }, { "id": "dns-enumeration-lookups", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host involving PsExec shell behavior", "condition": "the triage verdict is malicious for at least one host involving PsExec shell behavior", "blind_spot": "no-process-logs", "confidence": "high", "description": "Route the findings based on the agent's synthesized verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-precursors" } ] }, { "id": "isolate-beachhead", "type": "action", "label": "Isolate Endpoint", "config": { "target": "endpoint", "description": "Halt the intrusion before the adversary can manipulate VSS or extract secrets.", "instructions": "Isolate the affected host(s) and capture the memory of any active service-spawned shells for forensic analysis.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-confirmation", "type": "task", "label": "Analyst Breach Review", "config": { "assignee": "analyst", "description": "Review the synthesized findings and identify the 'patient zero' exploit path.", "instructions": "Examine hb_http_activity for the affected hosts to identify the specific URL or request that triggered the initial compromise. Compare timestamps of the vulnerability being first seen with the appearance of the PsExec behavior." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-beachhead" } ] } ] }