Sigma rule: Shadow Copies Deletion Using Operating Systems Utilities

Rule

Title

Shadow Copies Deletion Using Operating Systems Utilities

Status

stable

Level

high

Author

Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)

Date

2019-10-22

Modified

2022-11-03

File

rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Shadow Copies deletion using operating systems utilities

Log source

product

windows

category

process_creation

Detection

selection1_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
          - '\wmic.exe'
          - '\vssadmin.exe'
          - '\diskshadow.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'
          - 'wmic.exe'
          - 'VSSADMIN.EXE'
          - 'diskshadow.exe'
selection1_cli:
    CommandLine|contains|all:
        - 'shadow'  # will match "delete shadows" and "shadowcopy delete" and "shadowstorage"
        - 'delete'
selection2_img:
    - Image|endswith: '\wbadmin.exe'
    - OriginalFileName: 'WBADMIN.EXE'
selection2_cli:
    CommandLine|contains|all:
        - 'delete'
        - 'catalog'
        - 'quiet' # will match -quiet or /quiet
selection3_img:
    - Image|endswith: '\vssadmin.exe'
    - OriginalFileName: 'VSSADMIN.EXE'
selection3_cli:
    CommandLine|contains|all:
        - 'resize'
        - 'shadowstorage'
    CommandLine|contains:
        - 'unbounded'
        - '/MaxSize='
condition: (all of selection1*) or (all of selection2*) or (all of selection3*)

False positives (as the rule lists them)

• Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
• LANDesk LDClient Ivanti-PSModule (PS EncodedCommand)

Tags

• attack.impact
• attack.stealth
• attack.t1070
• attack.t1490

MITRE ATT&CK ids this rule names

• T1070
• T1490

References

• https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
• https://blog.talosintelligence.com/2017/05/wannacry.html
• https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/
• https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/
• https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
• https://github.com/Neo23x0/Raccine#the-process
• https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar
• https://redcanary.com/blog/intelligence-insights-october-2021/
• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml