mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2026-10-22 16:20:26 +02:00
Mario MadersbacherandJose Enrique Hernandez
67781fd49a
Adds Vssadmin.exe, requested in Backlog.txt. vssadmin delete shadows /all /quiet deletes all volume shadow copies on the host, a Tamper technique (T1490, Inhibit System Recovery) commonly used by ransomware to block file and system recovery. The binary is Microsoft-signed and ships in C:\Windows\System32 on Windows 10/11 and Server. Detection references the SigmaHQ rule for shadow copy deletion, which explicitly covers vssadmin.exe. Validated locally: python .github/workflows/validation.py and yamllint -c .github/.yamllint both pass for the new file. Co-authored-by: Jose Enrique Hernandez <josehelps@gmail.com>
21 lines
829 B
YAML
21 lines
829 B
YAML
---
|
|
Name: Vssadmin.exe
|
|
Description: Volume Shadow Copy Service administrative command-line tool
|
|
Author: mmadersbacher
|
|
Created: 2026-08-16
|
|
Commands:
|
|
- Command: vssadmin delete shadows /all /quiet
|
|
Description: Delete all volume shadow copies on the host without prompting
|
|
Usecase: Destroy shadow copies to prevent file and system recovery, a technique commonly used by ransomware
|
|
Category: Tamper
|
|
Privileges: Administrator
|
|
MitreID: T1490
|
|
OperatingSystem: Windows 11, Windows 10, Windows Server
|
|
Full_Path:
|
|
- Path: C:\Windows\System32\vssadmin.exe
|
|
Detection:
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml
|
|
Resources:
|
|
- Link: https://attack.mitre.org/techniques/T1490/
|
|
- Link: https://github.com/Neo23x0/Raccine
|