Windows PowerShell WMI Volume Shadow Copy Deletion

title: Windows PowerShell WMI Volume Shadow Copy Deletion
id: ea0fa494-39fd-4797-94e6-e6b1295e2a47
related:
  - id: e17121b4-ef2a-4418-8a59-12fb1631fa9e
    type: derived
  - id: c1337eb8-921a-4b59-855b-4ba188ddcc42
    type: similar
  - id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40
    type: derived
status: test
description: This rule matches process creation command lines that use PowerShell with WMI/CIM queries against Win32_ShadowCopy and include deletion actions such as .Delete(), Remove-WmiObject, or Remove-CimInstance. Deleting Volume Shadow Copies can hinder recovery by removing system restore points and prior backups, which is commonly leveraged during destructive attacks. Telemetry relies on Windows process creation logs capturing the PowerShell command line content, including WMI/CIM method invocations and Win32_ShadowCopy references.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
  - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_shadowcopy_deletion.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-20
modified: 2022-12-30
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_get:
    CommandLine|contains:
      - Get-WmiObject
      - gwmi
      - Get-CimInstance
      - gcim
  selection_shadowcopy:
    CommandLine|contains: Win32_ShadowCopy
  selection_delete:
    CommandLine|contains:
      - .Delete()
      - Remove-WmiObject
      - rwmi
      - Remove-CimInstance
      - rcim
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1