Windows Shadow Copy Deletion via PowerShell, WMIC, vssadmin, diskshadow, or wbadmin
Flags Windows commands that use shadow-copy management utilities with deletion or shadowstorage removal parameters.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) (SigmaHQ), DRL 1.1
- Published
- 2019-10-22
- Updated
- 2026-07-30
ATT&CK techniques
Defense Evasion → ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies Windows process executions where built-in utilities commonly used for managing Shadow Copies are invoked with command-line arguments indicating deletion or removal actions. Attackers and administrators may use these commands to eliminate recovery artifacts and hinder incident response or backup-based recovery. The detection relies on process creation telemetry, specifically the executable path/name and the presence of Shadow Copy-related and deletion/resizing terms in the command line.
Reporting behind it
- slideshare.nethttps://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- blog.talosintelligence.comhttps://blog.talosintelligence.com/2017/05/wannacry.html
- securingtomorrow.mcafee.comhttps://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/
- hybrid-analysis.comhttps://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
- github.comhttps://github.com/Neo23x0/Raccine#the-process
- github.comhttps://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar
- redcanary.comhttps://redcanary.com/blog/intelligence-insights-october-2021/
- symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-shadow-copy-deletion-via-powershell-wmic-vssadmin-diskshadow-or-wbadmin-c947b146
title: Windows Shadow Copy Deletion via PowerShell, WMIC, vssadmin, diskshadow, or wbadmin
id: bc40ba9f-99bc-4fec-9fc9-1cbf75d11f30
status: stable
description: This rule identifies Windows process executions where built-in utilities commonly used for managing Shadow Copies are invoked with command-line arguments indicating deletion or removal actions. Attackers and administrators may use these commands to eliminate recovery artifacts and hinder incident response or backup-based recovery. The detection relies on process creation telemetry, specifically the executable path/name and the presence of Shadow Copy-related and deletion/resizing terms in the command line.
references:
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://blog.talosintelligence.com/2017/05/wannacry.html
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/
- https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/
- https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
- https://github.com/Neo23x0/Raccine#the-process
- https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar
- https://redcanary.com/blog/intelligence-insights-october-2021/
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml
author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades), Huntrule Team
date: 2019-10-22
modified: 2022-11-03
tags:
- attack.impact
- attack.stealth
- attack.t1070
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection1_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- \wmic.exe
- \vssadmin.exe
- \diskshadow.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
- wmic.exe
- VSSADMIN.EXE
- diskshadow.exe
selection1_cli:
CommandLine|contains|all:
- shadow
- delete
selection2_img:
- Image|endswith: \wbadmin.exe
- OriginalFileName: WBADMIN.EXE
selection2_cli:
CommandLine|contains|all:
- delete
- catalog
- quiet
selection3_img:
- Image|endswith: \vssadmin.exe
- OriginalFileName: VSSADMIN.EXE
selection3_cli:
CommandLine|contains|all:
- resize
- shadowstorage
CommandLine|contains:
- unbounded
- /MaxSize=
condition: (all of selection1*) or (all of selection2*) or (all of selection3*)
falsepositives:
- Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
- LANDesk LDClient Ivanti-PSModule (PS EncodedCommand)
level: high
license: DRL-1.1
related:
- id: c947b146-0abc-4c87-9c64-b17e9d7274a2
type: derived