tsale-EDR-Telemetry/Tools/Telemetry-Generator/Windows/VSSDelete

VssDeletePOC

This is a simple proof-of-concept for deleting the first available Volume Shadow Copy Service (VSS) snapshot on Windows.
It uses the AlphaVSS library.

Setup & Run

1. Create a new console project:

   dotnet new console -n VssDeletePOC
   cd VssDeletePOC
   

2. Add the dependency:

   dotnet add package AlphaVSS
   cd VssDeletePOC
   

   If you see an error about no versions available, run:

   dotnet nuget add source https://api.nuget.org/v3/index.json -n nuget.org
   

3. Replace the content of Program.cs with the content of Program.cs.
4. Run the program:

   dotnet run
   

Build & Run as Executable

1. Install the Visual C++ Redistributable (x64).

2. Publish a self-contained executable (64-bit):

   dotnet publish -c Release -r win-x64 --self-contained true
   

3. Run the generated .exe (requires Administrator privileges).

---

Creating a VSS Snapshot

If you don't have a VSS snapshot already, on a Windows server, you can create one using the following command:

vssadmin create shadow /for=C:

Replace C: with the drive letter you want to snapshot.

You can verify that the snapshot was created by running:

vssadmin list shadows