vssadmin.exe
Summary
Volume Shadow Copy Service administration tool (vssadmin.exe) manages volume shadow copies — point-in-time snapshots of disk volumes used for backup and restore. It can create, list, resize, and delete shadow copies.
vssadmin.exe is the 378th most commonly executed Windows program in EchoTrail's dataset, observed 21,137 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by powershell.exe.
Behavior
Top Paths
- C:\Windows\System3299.96%
- C:\Windows\SysWOW640.04%
Top Hashes (SHA256)
- af08da2358d55665fae06ae694129b5f3778989e93f5f369e0b594e1a2bc521e98.08%
- 4c5616bbe7bd863fcc17fd6ef663ef564d72acc40e9663e198fff2f27a2aa6c71.73%
- 8c1fabcc2196e4d096b7d155837c5f699ad7f55edbf84571e4f8e03500b7a8b00.14%
- 9d3cee88e010136e3bf9a1e519549cf5ca270284a1fc0830a0e9bed2bfd6e76a0.04%
- 4016e8ef6bcb7ce6fd86e4e44912cd1dab7f80147d11133d18fd1a8785ca0de50.01%
Process Ancestry
Top Grandparents
- svchost.exe98.86%
- cmd.exe0.73%
- explorer.exe0.21%
Top Parents
- powershell.exe45.03%
- cmd.exe42.35%
- taskeng.exe12.57%
- python.exe0.03%
- SAAZJobDownload.exe0.01%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does vssadmin.exe normally do?
Located in C:\Windows\System32. Launched by powershell.exe, cmd.exe, and taskeng.exe. Used by backup software and system restore operations.
When is vssadmin.exe suspicious?
Deleting shadow copies: vssadmin delete shadows /all /quiet — this is a hallmark of ransomware preparation. Resizing shadow storage to zero. Any delete operation outside of known backup maintenance windows.
How do attackers abuse vssadmin.exe?
Ransomware preparation: virtually all ransomware deletes volume shadow copies before encrypting files to prevent victims from restoring without paying. vssadmin delete shadows /all /quiet is one of the most reliable ransomware indicators. Also seen with wmic shadowcopy delete and PowerShell equivalents. Data destruction: deleting shadow copies as part of data destruction attacks.
Detection guidance
High-confidence: vssadmin delete shadows (any variation). vssadmin resize shadowstorage with /maxsize= set to a very small value. These are among the highest-fidelity detections available — legitimate shadow copy deletion is rare outside of scheduled backup maintenance. Also monitor for wmic shadowcopy delete and Get-WmiObject Win32_ShadowCopy | ForEach-Object { $_.Delete() } as alternative methods.
False positive notes
Backup software may manage shadow copies. System administrators occasionally clean up shadow copies for disk space. Scheduled tasks from backup products (e.g., Veeam, BackupExec) may use vssadmin. These should be baselined and excluded.
Related Processes
Ask Rocky about vssadmin.exe
Rocky answers questions about vssadmin.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.