The vssadmin.exe command line tool is often used to delete volume shadow copies of file as part of a ransomware attack. A ransomware attack involves a malicious executable that encrypts all the files on a victim computer so that the user can no longer access them. The user is then instructed to pay a ransom in order to get their files back. These attacks are very common and often very effective in their effort to get their victim’s to pay the ransom. Vssadmin.exe is used by the ransomware malware to delete any backups of the files so that the user can’t restore the files themselves and are forced to pay the ransom if they want their files back. To detect potential ransomware activity, look for vssadmin.exe executing with certain keywords in the command line, such as delete, shadows or shadowcopy. Outside of a ransomware attack, this would be highly unusual activity worth investigating.