vssadmin.exe
Sources: 300M+ executions observed in the wild.
Summary
Volume Shadow Copy Service administration tool (vssadmin.exe) manages volume shadow copies — point-in-time snapshots of disk volumes used for backup and restore. It can create, list, resize, and delete shadow copies.
vssadmin.exe is the 378th most commonly executed Windows program in EchoTrail's dataset, observed 21,137 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by powershell.exe.
Get this in your tools
The same record for vssadmin.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/vssadmin.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3299.96%
- C:\Windows\SysWOW640.04%
Top Hashes (SHA256)
- af08da2358d55665fae06ae694129b5f3778989e93f5f369e0b594e1a2bc521e98.08%
- 4c5616bbe7bd863fcc17fd6ef663ef564d72acc40e9663e198fff2f27a2aa6c71.73%
- 8c1fabcc2196e4d096b7d155837c5f699ad7f55edbf84571e4f8e03500b7a8b00.14%
- 9d3cee88e010136e3bf9a1e519549cf5ca270284a1fc0830a0e9bed2bfd6e76a0.04%
- 4016e8ef6bcb7ce6fd86e4e44912cd1dab7f80147d11133d18fd1a8785ca0de50.01%
Process Ancestry
Top Grandparents
- svchost.exe98.86%
- cmd.exe0.73%
- explorer.exe0.21%
Top Parents
- powershell.exe45.03%
- cmd.exe42.35%
- taskeng.exe12.57%
- python.exe0.03%
- SAAZJobDownload.exe0.01%
Top Children
- conhost.exe100%
Security Analysis
What does vssadmin.exe normally do?
Located in C:\Windows\System32. Launched by powershell.exe, cmd.exe, and taskeng.exe. Used by backup software and system restore operations.
When is vssadmin.exe suspicious?
Deleting shadow copies: vssadmin delete shadows /all /quiet — this is a hallmark of ransomware preparation. Resizing shadow storage to zero. Any delete operation outside of known backup maintenance windows.
How do attackers abuse vssadmin.exe?
Ransomware preparation: virtually all ransomware deletes volume shadow copies before encrypting files to prevent victims from restoring without paying. vssadmin delete shadows /all /quiet is one of the most reliable ransomware indicators. Also seen with wmic shadowcopy delete and PowerShell equivalents. Data destruction: deleting shadow copies as part of data destruction attacks.
Detection guidance
High-confidence: vssadmin delete shadows (any variation). vssadmin resize shadowstorage with /maxsize= set to a very small value. These are among the highest-fidelity detections available — legitimate shadow copy deletion is rare outside of scheduled backup maintenance. Also monitor for wmic shadowcopy delete and Get-WmiObject Win32_ShadowCopy | ForEach-Object { $_.Delete() } as alternative methods.
False positive notes
Backup software may manage shadow copies. System administrators occasionally clean up shadow copies for disk space. Scheduled tasks from backup products (e.g., Veeam, BackupExec) may use vssadmin. These should be baselined and excluded.
Related Processes
Ask Rocky about vssadmin.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for vssadmin.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.