huntrule

Windows PowerShell WMI Volume Shadow Copy Deletion

Flags PowerShell WMI/CIM commands that query Win32_ShadowCopy and attempt deletion.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Tim Rauch, Elastic (idea) (SigmaHQ), DRL 1.1
Published
2022-09-20
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches process creation command lines that use PowerShell with WMI/CIM queries against Win32_ShadowCopy and include deletion actions such as .Delete(), Remove-WmiObject, or Remove-CimInstance. Deleting Volume Shadow Copies can hinder recovery by removing system restore points and prior backups, which is commonly leveraged during destructive attacks. Telemetry relies on Windows process creation logs capturing the PowerShell command line content, including WMI/CIM method invocations and Win32_ShadowCopy references.

Reporting behind it

Related detections9 linkedT1490 — drag to rearrange
Suspicious Symlink Evaluation Enabled via fsutil
Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware
Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware
Malicious Volume Shadow Copy Deletion via vssadmin or WMIC
Malicious Volume Shadow Copy Deletion via vssadmin
Suspicious Free Space Wipe via cipher.exe
Malicious Shadow Copy Deletion Via WMI
Volume Shadow Copy Deletion via vssadmin or wmic
Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)
Windows PowerShell WMI Volume Shadow Copy Deletion
Pivot detection · T1490 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.