Windows WMI Shadow Copy Deletion via PowerShell
Identifies PowerShell commands that use WMI Win32_ShadowCopy to delete or remove Volume Shadow Copies.
- Product
- windows
- Category
- ps_classic_start
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-06-03
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies PowerShell commands that use WMI (Get-WmiObject) targeting Win32_ShadowCopy and invoking deletion methods such as Delete() or Remove-WmiObject. Deleting Volume Shadow Copies can hinder incident response and recovery by removing prior system snapshots that may contain evidence. Telemetry relies on classic PowerShell process command content where both the WMI query and the shadow copy deletion indicators appear.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md
- fortinet.comhttps://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WMI Shadow Copy Deletion via PowerShell
id: 45ab950d-fdc8-4b06-82d2-80c9ebb5e9c2
status: stable
description: This rule identifies PowerShell commands that use WMI (Get-WmiObject) targeting Win32_ShadowCopy and invoking deletion methods such as Delete() or Remove-WmiObject. Deleting Volume Shadow Copies can hinder incident response and recovery by removing prior system snapshots that may contain evidence. Telemetry relies on classic PowerShell process command content where both the WMI query and the shadow copy deletion indicators appear.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md
- https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml
author: frack113, Huntrule Team
date: 2021-06-03
modified: 2023-10-27
tags:
- attack.impact
- attack.t1490
logsource:
product: windows
category: ps_classic_start
detection:
selection:
Data|contains|all:
- Get-WmiObject
- Win32_ShadowCopy
Data|contains:
- Delete()
- Remove-WmiObject
condition: selection
falsepositives:
- Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
level: high
license: DRL-1.1
related:
- id: 87df9ee1-5416-453a-8a08-e8d4a51e9ce1
type: derived