VSSShield

If you are using tools that can access vssadmin.exe, then you are probably aware of the risks associated with it. In short, this is the Volume Shadow Copy Service that permits the manual and automatic management of the backup copies of the PC snapshots regardless of whether they are in use. It could be easily confused for ransomware.

VSSShield is a tiny tool designed to act as a debugger for vssadmin.exe and wmic.exe that keeps an eye out for attempts to delete the shadow copies on your system. It is important to note that the program doesn’t prevent the deletion process, but rather acts promptly to kill the parent process.

The tool works with the WMIC as well, a process that has been widely abused by threat actors over the past few years. More precisely, the WMIC command can be used to delete the Shadow Volume Copies and hence, make it impossible to recover data from that computer.

In a way, the utility works as a mitigator and consequently, the developer underlines that it should never be considered as a security tool that can protect the system from malware and particularly, ransomware attacks. Make sure to apply the basic security measures to avoid getting ransomware on your system.