vssadmin.exe

  • File Path: C:\windows\system32\vssadmin.exe
  • Description: Command Line Interface for Microsoft Volume Shadow Copy Service

Hashes

Type Hash
MD5 D9EE4ACBA0FD5AF721EC2CE5226B5E2E
SHA1 0FAD587565EBEA4054FD282C6CC5FAD5CEF02E6D
SHA256 AF08DA2358D55665FAE06AE694129B5F3778989E93F5F369E0B594E1A2BC521E
SHA384 C285740B87D4E076FA2D9E3374503192108B78F7768A7D0A6DC39C79E5CCBF0F48AB95D8CB30E2B9160CAFECFFFB6A79
SHA512 42C6B608D35FF0820F492BF66AA1E95D735CDBBAD2D967679273994BBB140069949D31EF5F4403B3A0DBE6A0C1E4DB9BE0F8B03BF53881CDBAC5BCEE3EFFBD31
SSDEEP 3072:Um47pah9kD4dYloFC+xT3J5wonkWNOYQNR6n:Um47p+9kD4djN3PwWkWNOXNR6

Signature

  • Status: The file C:\windows\system32\vssadmin.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
  • Serial: ``
  • Thumbprint: ``
  • Issuer:
  • Subject:

File Metadata

  • Original Filename: VSSADMIN.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
  • Product Version: 6.3.9600.16384
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of vssadmin.exe being misused. While vssadmin.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma godmode_sigma_rule.yml - 'vssadmin delete shadows' # Ransomware DRL 1.0
sigma sysmon_suspicious_remote_thread.yml - '\vssadmin.exe' DRL 1.0
sigma win_susp_vssadmin_ntds_activity.yml - https://www.trustwave.com/Resources/SpiderLabs-Blog/Tutorial-for-NTDS-goodness-(VSSADMIN,-WMIS,-NTDS-dit,-SYSTEM)/ DRL 1.0
sigma win_susp_vssadmin_ntds_activity.yml - vssadmin.exe Delete Shadows DRL 1.0
sigma win_susp_vssadmin_ntds_activity.yml - 'vssadmin create shadow /for=C:' DRL 1.0
sigma win_susp_vssadmin_ntds_activity.yml - 'vssadmin delete shadows /for=C:' DRL 1.0
sigma proc_creation_win_apt_hafnium.yml - 'vssadmin list shadows' DRL 1.0
sigma proc_creation_win_malware_conti.yml - 'vssadmin list shadows' DRL 1.0
sigma proc_creation_win_multiple_suspicious_cli.yml - vssadmin.exe DRL 1.0
sigma proc_creation_win_shadow_copies_creation.yml - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/ DRL 1.0
sigma proc_creation_win_shadow_copies_creation.yml - '\vssadmin.exe' DRL 1.0
sigma proc_creation_win_shadow_copies_deletion.yml - https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/ DRL 1.0
sigma proc_creation_win_shadow_copies_deletion.yml - '\vssadmin.exe' DRL 1.0
sigma proc_creation_win_shadow_copies_deletion.yml Image\|endswith: '\vssadmin.exe' DRL 1.0
sigma proc_creation_win_susp_system_user_anomaly.yml - 'vssadmin delete shadows' # Ransomware DRL 1.0
sigma proc_creation_win_webshell_detection.yml - '\vssadmin.exe' DRL 1.0
LOLBAS Wmic.yml - Command: wmic.exe /node:REMOTECOMPUTERNAME PROCESS call create "cmd /c vssadmin create shadow /for=C:\Windows\NTDS\NTDS.dit > c:\not_the_NTDS.dit"  
atomic-red-team index.md - Atomic Test #1: Create Volume Shadow Copy with vssadmin [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #1: Create Volume Shadow Copy with vssadmin [windows] MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md - Atomic Test #1 - Create Volume Shadow Copy with vssadmin MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md ## Atomic Test #1 - Create Volume Shadow Copy with vssadmin MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md vssadmin.exe create shadow /for=#{drive_letter} MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md This test requires steps taken in the test “Create Volume Shadow Copy with vssadmin”. MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md echo Run “Invoke-AtomicTest T1003.003 -TestName ‘Create Volume Shadow Copy with vssadmin’” to fulfill this requirement MIT License. © 2018 Red Canary
atomic-red-team T1490.md * vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet MIT License. © 2018 Red Canary
atomic-red-team T1490.md vssadmin.exe delete shadows /all /quiet MIT License. © 2018 Red Canary
atomic-red-team T1490.md if(!(vssadmin.exe list shadows | findstr “No items found that satisfy the query.”)) { exit 0 } else { exit 1 } MIT License. © 2018 Red Canary
atomic-red-team T1490.md vssadmin.exe create shadow /for=c: MIT License. © 2018 Red Canary
signature-base apt_grizzlybear_uscert.yar $b = “vssadmin delete shadows” ascii wide nocase CC BY-NC 4.0
signature-base crime_ransom_germanwiper.yar $KillShadowCopies = “vssadmin.exe delete shadows” ascii CC BY-NC 4.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

vssadmin

Applies to: Windows Server 2022, Windows Server 2019, Windows 10, Windows 8.1, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008

Displays current volume shadow copy backups and all installed shadow copy writers and providers. Select a command name in the following table view its command syntax.

Command Description Availability
vssadmin delete shadows Deletes volume shadow copies. Client and Server
vssadmin list shadows Lists existing volume shadow copies. Client and Server
vssadmin list writers Lists all subscribed volume shadow copy writers on the system. Client and Server
vssadmin resize shadowstorage Resizes the maximum size for a shadow copy storage association. Client and Server

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.