Vssadmin.exe

Commands

1. TamperAdministrator T1490

   Destroy shadow copies to prevent file and system recovery, a technique commonly used by ransomware

   vssadmin delete shadows /all /quiet

   Delete all volume shadow copies on the host without prompting

   os: Windows 11, Windows 10, Windows Server

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml

Resources

• https://attack.mitre.org/techniques/T1490/
• https://github.com/Neo23x0/Raccine