PowerShell WMI Script Deletes Windows Volume Shadow Copies
Flags PowerShell WMI/CIM scripts that enumerate Win32_ShadowCopy and attempt to delete it.
- Product
- windows
- Category
- ps_script
- Author
- Tim Rauch, frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-09-20
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies PowerShell activity that uses WMI/CIM queries against Win32_ShadowCopy and then attempts to delete shadow copy instances. Deleting Volume Shadow Copies can remove recovery points and is a common step in impact-focused attacks. The detection relies on PowerShell script block text containing WMI/CIM command patterns and deletion methods targeting Win32_ShadowCopy.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
- elastic.cohttps://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell WMI Script Deletes Windows Volume Shadow Copies
id: a2c368dc-7f74-4d1e-b03a-518fa2b1eb4b
related:
- id: e17121b4-ef2a-4418-8a59-12fb1631fa9e
type: derived
- id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40
type: similar
- id: c1337eb8-921a-4b59-855b-4ba188ddcc42
type: derived
status: test
description: This rule identifies PowerShell activity that uses WMI/CIM queries against Win32_ShadowCopy and then attempts to delete shadow copy instances. Deleting Volume Shadow Copies can remove recovery points and is a common step in impact-focused attacks. The detection relies on PowerShell script block text containing WMI/CIM command patterns and deletion methods targeting Win32_ShadowCopy.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
- https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml
author: Tim Rauch, frack113, Huntrule Team
date: 2022-09-20
modified: 2022-12-02
tags:
- attack.impact
- attack.t1490
logsource:
category: ps_script
product: windows
detection:
selection_get:
ScriptBlockText|contains:
- Get-WmiObject
- gwmi
- Get-CimInstance
- gcim
selection_shadowcopy:
ScriptBlockText|contains: Win32_ShadowCopy
selection_delete:
ScriptBlockText|contains:
- .Delete()
- Remove-WmiObject
- rwmi
- Remove-CimInstance
- rcim
condition: all of selection*
falsepositives:
- Unknown
level: high
license: DRL-1.1