Windows WMI Shadow Copy Deletion via PowerShell (Get-WmiObject Win32_ShadowCopy)

Identifies PowerShell commands that use WMI Win32_ShadowCopy to delete or remove Volume Shadow Copies.

FreeUnreviewedSigmahighv1

windows-wmi-shadow-copy-deletion-via-powershell-get-wmiobject-win32-shadowcopy-87df9ee1

title: Windows WMI Shadow Copy Deletion via PowerShell (Get-WmiObject Win32_ShadowCopy)
id: 45ab950d-fdc8-4b06-82d2-80c9ebb5e9c2
status: stable
description: This rule flags PowerShell activity that queries the WMI class Win32_ShadowCopy and attempts to remove it using delete methods. Deleting Volume Shadow Copies can impede recovery and cleanup evidence after malicious activity, making it a high-impact indicator. It relies on PowerShell command/script text telemetry matching for Get-WmiObject targeting Win32_ShadowCopy along with Delete() or Remove-WmiObject.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md
  - https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml
author: frack113, Huntrule Team
date: 2021-06-03
modified: 2023-10-27
tags:
  - attack.impact
  - attack.t1490
logsource:
  product: windows
  category: ps_classic_start
detection:
  selection:
    Data|contains|all:
      - Get-WmiObject
      - Win32_ShadowCopy
    Data|contains:
      - Delete()
      - Remove-WmiObject
  condition: selection
falsepositives:
  - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
level: high
license: DRL-1.1
related:
  - id: 87df9ee1-5416-453a-8a08-e8d4a51e9ce1
    type: derived

What it detects

This rule flags PowerShell activity that queries the WMI class Win32_ShadowCopy and attempts to remove it using delete methods. Deleting Volume Shadow Copies can impede recovery and cleanup evidence after malicious activity, making it a high-impact indicator. It relies on PowerShell command/script text telemetry matching for Get-WmiObject targeting Win32_ShadowCopy along with Delete() or Remove-WmiObject.

Known false positives

Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.