huntrule

PowerShell WMI Script Deletion of Windows Volume Shadow Copies

Flags PowerShell WMI/CIM scripts that enumerate Win32_ShadowCopy and attempt to delete it.

FreeUnreviewedSigmahighv1
title: PowerShell WMI Script Deletion of Windows Volume Shadow Copies
id: a2c368dc-7f74-4d1e-b03a-518fa2b1eb4b
related:
  - id: e17121b4-ef2a-4418-8a59-12fb1631fa9e
    type: derived
  - id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40
    type: similar
  - id: c1337eb8-921a-4b59-855b-4ba188ddcc42
    type: derived
status: test
description: This rule detects PowerShell script blocks that use WMI/CIM to target Win32_ShadowCopy objects and invoke deletion methods (e.g., .Delete()) or removal cmdlets such as Remove-WmiObject/Remove-CimInstance. Deleting Volume Shadow Copies can hinder system recovery and is a common destructive step in attacks. It relies on PowerShell ScriptBlockText telemetry capturing the presence of WMI/CIM queries for Win32_ShadowCopy along with deletion-related calls.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
  - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml
author: Tim Rauch, frack113, Huntrule Team
date: 2022-09-20
modified: 2022-12-02
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: ps_script
  product: windows
detection:
  selection_get:
    ScriptBlockText|contains:
      - Get-WmiObject
      - gwmi
      - Get-CimInstance
      - gcim
  selection_shadowcopy:
    ScriptBlockText|contains: Win32_ShadowCopy
  selection_delete:
    ScriptBlockText|contains:
      - .Delete()
      - Remove-WmiObject
      - rwmi
      - Remove-CimInstance
      - rcim
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule detects PowerShell script blocks that use WMI/CIM to target Win32_ShadowCopy objects and invoke deletion methods (e.g., .Delete()) or removal cmdlets such as Remove-WmiObject/Remove-CimInstance. Deleting Volume Shadow Copies can hinder system recovery and is a common destructive step in attacks. It relies on PowerShell ScriptBlockText telemetry capturing the presence of WMI/CIM queries for Win32_ShadowCopy along with deletion-related calls.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.