Windows PowerShell WMI Volume Shadow Copy Deletion
Flags PowerShell WMI/CIM commands that query Win32_ShadowCopy and attempt deletion.
- Product
- windows
- Category
- process_creation
- Author
- Tim Rauch, Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-09-20
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule matches process creation command lines that use PowerShell with WMI/CIM queries against Win32_ShadowCopy and include deletion actions such as .Delete(), Remove-WmiObject, or Remove-CimInstance. Deleting Volume Shadow Copies can hinder recovery by removing system restore points and prior backups, which is commonly leveraged during destructive attacks. Telemetry relies on Windows process creation logs capturing the PowerShell command line content, including WMI/CIM method invocations and Win32_ShadowCopy references.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
- elastic.cohttps://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_shadowcopy_deletion.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell WMI Volume Shadow Copy Deletion
id: ea0fa494-39fd-4797-94e6-e6b1295e2a47
related:
- id: e17121b4-ef2a-4418-8a59-12fb1631fa9e
type: derived
- id: c1337eb8-921a-4b59-855b-4ba188ddcc42
type: similar
- id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40
type: derived
status: test
description: This rule matches process creation command lines that use PowerShell with WMI/CIM queries against Win32_ShadowCopy and include deletion actions such as .Delete(), Remove-WmiObject, or Remove-CimInstance. Deleting Volume Shadow Copies can hinder recovery by removing system restore points and prior backups, which is commonly leveraged during destructive attacks. Telemetry relies on Windows process creation logs capturing the PowerShell command line content, including WMI/CIM method invocations and Win32_ShadowCopy references.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
- https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_shadowcopy_deletion.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-20
modified: 2022-12-30
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_get:
CommandLine|contains:
- Get-WmiObject
- gwmi
- Get-CimInstance
- gcim
selection_shadowcopy:
CommandLine|contains: Win32_ShadowCopy
selection_delete:
CommandLine|contains:
- .Delete()
- Remove-WmiObject
- rwmi
- Remove-CimInstance
- rcim
condition: all of selection*
falsepositives:
- Unknown
level: high
license: DRL-1.1