LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Vssadmin.exe

View source

Volume Shadow Copy Service administrative command-line tool

Tamper
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Tamper1

EXAMPLE 01T1490

Delete all volume shadow copies on the host without prompting

COMMAND
vssadmin delete shadows /all /quiet
USE CASE
Destroy shadow copies to prevent file and system recovery, a technique commonly used by ransomware
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 11, Windows 10, Windows Server
02 / ON DISK

Known paths

C:\Windows\System32\vssadmin.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources