vssadmin delete shadows

What the command does

vssadmin delete shadows is a Windows command-line action that removes Volume Shadow Copy snapshots. In practice, it is used to destroy restore points that could help a victim recover files after encryption or tampering.

Because shadow copies are a built-in recovery layer, deleting them turns a local incident into a much harder business continuity problem. It is especially disruptive when the command is run after privilege escalation or alongside backup interference.

Why attackers use it

The command is a common ransomware enabler because it targets recovery rather than encryption itself. Attackers often prefer it when they want to reduce the chance that users or administrators can roll back affected files without paying or rebuilding systems.

This is why shadow copy deletion is often treated as a strong signal of malicious post-exploitation activity, not just an administrative maintenance task. When seen with mass file changes or suspicious command-line activity, it usually indicates an attempt to lock in impact.

How organisations detect exposure

Exposure is easiest to assess by combining endpoint telemetry, privileged activity review, and backup architecture review. Teams should know which systems can invoke volume shadow copy management, which accounts can do so, and whether those systems are already visible in logging and alerting.

Defenders should look for the command in process creation logs, script activity, and privileged command execution, then correlate it with file encryption, backup-job interruption, or other recovery-related tampering. MITRE ATT&CK Enterprise Matrix is useful for mapping that behaviour to attacker tradecraft, while Living off the Land Guide helps place the command in the broader family of dual-use Windows utilities.

How to reduce the damage

The main defence is to make shadow copy deletion harder to execute and less valuable when it does occur. That means limiting who can run recovery-destructive commands, monitoring administrative shells closely, and ensuring backups are isolated enough that one compromised host cannot erase every recovery option.

Immutable or offline backups matter because they reduce the attacker’s leverage even if local snapshots are removed. Ransomware Prevention Guide covers shadow copy protection and resilient backup design, and NIST Cybersecurity Framework 2.0 provides the governance and recovery structure for making those controls operational.

Risk and Threat Considerations

Deleting shadow copies does not create the ransomware event, but it materially increases its impact by removing one of the fastest recovery paths. The risk is highest when the command appears in a sequence that includes privilege escalation, backup tampering, or broad file encryption.

Failure mechanism: The attacker removes local restoration points after gaining sufficient privilege, which blocks straightforward rollback and pushes the victim toward disruptive recovery methods.

Impact: Recovery time increases, data loss becomes more likely, and the organisation’s leverage against extortion or destructive malware drops sharply.

Related resources from NHI Mgmt Group

• How do attackers use vssadmin delete shadows?
• How can security teams detect vssadmin delete shadows?
• What mitigations reduce the risk of vssadmin delete shadows?
• Why do leaked secrets remain a problem after developers delete them?