Vssadmin.exe

Delete all volume shadow copies on the host without prompting

Use Destroy shadow copies to prevent file and system recovery, a technique commonly used by ransomware

vssadmin delete shadows /all /quiet

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Tamper

MITRE

T1490

Detection

Sigma: github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml

Refs

attack.mitre.org/techniques/T1490/

github.com/Neo23x0/Raccine

lolbas-project.github.io/lolbas/Binaries/Vssadmin/