Sigma detection rules, expert-reviewed

Malicious Volume Shadow Copy Deletion for Ransomware Recovery Inhibition

This rule detects deletion of volume shadow copies and disabling of Windows recovery through vssadmin wmic and bcdedit as performed prior to Hive ransomware encryption and this matters because destroying shadow copies and recovery options immediately before mass file encryption is a defining behavior of ransomware impact and rarely legitimate on production systems.

Malicious Volume Shadow Copy Deletion via wmic and vssadmin (via process_creation)

This rule detects deletion of volume shadow copies through wmic shadowcopy delete and vssadmin Delete Shadows commands. This behavior is used by the Helldown ransomware to inhibit system recovery prior to encrypting files. Removing shadow copies prevents victims from restoring their data which maximizes the impact of the intrusion.

Malicious Shadow Copy Deletion via WMIC via Process Creation (via process_creation)

This rule detects WMIC being used to enumerate and delete Volume Shadow Copies, an inhibit-recovery step performed before encryption in the Confluence exploitation ransomware intrusion reported by Red Canary. Removing shadow copies prevents victims from restoring encrypted files, so this command is a strong precursor to imminent ransomware detonation.

Malicious Shadow Copy Removal via WMI PowerShell

This rule detects PowerShell enumerating and removing volume shadow copies through the Win32_Shadowcopy WMI class. This behavior matches Akira ransomware which deletes shadow copies via WMI to prevent recovery before encrypting files. Programmatic shadow copy removal is a strong impact indicator that precedes ransomware detonation.

Malicious Volume Shadow Copy Deletion via vssadmin

This rule detects deletion of all volume shadow copies via vssadmin with the quiet flag. This behavior matches BlackSuit ransomware operated by Ignoble Scorpius which removes shadow copies to inhibit system recovery before encryption. Shadow copy deletion is a strong pre-encryption indicator and warrants immediate response to prevent irreversible data loss.

Malicious Inhibit System Recovery via Shadow Copy and Boot Config Tampering (via process_creation)

This rule detects deletion of Volume Shadow Copies via vssadmin or wmic and disabling of Windows recovery via bcdedit, the recovery-inhibition sequence Repellent Scorpius runs before deploying Cicada3301 ransomware. Destroying backups and recovery options maximizes encryption impact and pressures victims to pay.

Malicious NTDS Extraction from Volume Shadow Copy by RA World

This rule detects copying of the Active Directory database or SAM and SYSTEM hives out of a volume shadow copy through a GLOBALROOT HarddiskVolumeShadowCopy path, a credential theft step used by the RA World ransomware group. Reading domain secrets from a shadow copy bypasses locks on the live files. Detecting this exposes domain credential harvesting ahead of ransomware deployment.

Suspicious Volume Shadow Copy Deletion via vssadmin or wmic

This rule detects deletion of volume shadow copies using vssadmin or wmic, an inhibit recovery step performed by The Gentlemen ransomware before encryption. Removing shadow copies prevents victims from restoring files and is a strong pre-encryption indicator of a destructive attack.

Malicious NTDS.dit Access via Shadow Copy GLOBALROOT Path

This rule detects access to ntds.dit through a GLOBALROOT volume shadow copy device path. The CloudComputating group copied the Active Directory database directly from a shadow copy to steal domain credentials while bypassing file locks on the live NTDS.dit.

Suspicious Shadow Copy Creation via WMIC (via process_creation)

This rule detects use of wmic to invoke shadowcopy call create which ToddyCat performs to snapshot the volume and then archive the Chrome shadow copy for offline browser credential and data theft.

Malicious Akira Shadow Copy Deletion via PowerShell WMI (via process_creation)

This rule detects PowerShell enumerating and deleting Volume Shadow Copies through WMI. Akira ransomware runs a PowerShell one-liner that queries Win32_Shadowcopy and calls Delete to remove backups before encryption, so this command indicates inhibition of system recovery during a ransomware attack.

Malicious Shadow Copy Deletion via WMI PowerShell

This rule detects PowerShell querying Win32_Shadowcopy through WMI and deleting the returned shadow copies, an alternative recovery-inhibition technique that avoids the vssadmin binary. It is associated with REvil ransomware-as-a-service affiliate operations seeking to destroy backups prior to encryption. Detecting the WMI-based variant closes a common evasion gap around shadow copy deletion.

Malicious Shadow Copy Deletion via WMI PowerShell (via ps_script)

This rule detects PowerShell that queries the Win32_Shadowcopy WMI class and then deletes the returned instances. Ransomware uses this WMI approach to remove Volume Shadow Copies without invoking vssadmin, evading command-line detections focused on that utility. Scripted shadow copy destruction through WMI is a clear recovery-inhibition behavior.

Malicious Volume Shadow Copy Deletion via Vssadmin

This rule detects vssadmin being invoked to delete all volume shadow copies quietly, a recovery-inhibition step performed before file encryption. It is associated with REvil ransomware-as-a-service affiliate operations that wipe backups to prevent victims from restoring encrypted data. Catching this activity provides an early signal that ransomware deployment is imminent.

Malicious Volume Shadow Copy Deletion for Recovery Inhibition

This rule detects deletion of volume shadow copies through vssadmin, wmic or PowerShell, the recovery-inhibition step used by the Handala group and many destructive operations before encryption or wiping. Removing shadow copies prevents victims from restoring affected files. Administrative shadow copy deletion on endpoints is uncommon and warrants review alongside other impact indicators.