From 87947d7b6fda30abc2029fbba875b375b635bea4 Mon Sep 17 00:00:00 2001 From: mmadersbacher Date: Sun, 16 Aug 2026 22:10:42 +0200 Subject: [PATCH] Add Vssadmin.exe (delete shadows, Tamper/T1490) --- yml/OSBinaries/Vssadmin.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 yml/OSBinaries/Vssadmin.yml diff --git a/yml/OSBinaries/Vssadmin.yml b/yml/OSBinaries/Vssadmin.yml new file mode 100644 index 00000000..2042f507 --- /dev/null +++ b/yml/OSBinaries/Vssadmin.yml @@ -0,0 +1,20 @@ +--- +Name: Vssadmin.exe +Description: Volume Shadow Copy Service administrative command-line tool +Author: mmadersbacher +Created: 2026-08-16 +Commands: + - Command: vssadmin delete shadows /all /quiet + Description: Delete all volume shadow copies on the host without prompting + Usecase: Destroy shadow copies to prevent file and system recovery, a technique commonly used by ransomware + Category: Tamper + Privileges: Administrator + MitreID: T1490 + OperatingSystem: Windows 11, Windows 10, Windows Server +Full_Path: + - Path: C:\Windows\System32\vssadmin.exe +Detection: + - Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml +Resources: + - Link: https://attack.mitre.org/techniques/T1490/ + - Link: https://github.com/Neo23x0/Raccine