---
id: 8169
title: "Getting Started with WMI Weaponization – Part 4"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/adversary-simulation/getting-started-wmi-weaponization-part-4/"
published_at: "2017-04-13T00:00:00Z"
tags: ["active-directory", "wmi", "ntds-dit", "credential-dumping", "volume-shadow-copy"]
phying_url: "https://phying.com/item/8169"
lang: en
---

# Getting Started with WMI Weaponization – Part 4

## Summary

Replicates ntds.dit dumping with pure WMI Win32_ShadowCopy calls instead of vssadmin, remotely snapshotting a domain controller to pull password hashes while trimming the tool-based IoC footprint.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2017-04-13T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/adversary-simulation/getting-started-wmi-weaponization-part-4/
- **Phying News:** https://phying.com/item/8169