Sigma detection rules, expert-reviewed

Malicious Volume Shadow Copy Deletion Before Ransomware Encryption

This rule detects deletion of Volume Shadow Copies through vssadmin, wmic or PowerShell, an inhibit-recovery step the Qilin ransomware group performs before encrypting files. Removing shadow copies prevents victims from restoring data without paying. This activity almost always precedes or accompanies encryption.

Malicious Volume Shadow Copy Deletion via Vssadmin or WMIC (via process_creation)

This rule detects deletion of Volume Shadow Copies through vssadmin or wmic. Ransomware removes shadow copies so that victims cannot roll back encrypted files from local snapshots, maximizing pressure to pay. Programmatic shadow copy deletion is a well-established impact behavior seen immediately before or during encryption.

Malicious Volume Shadow Copy Deletion via vssadmin

This rule detects deletion of volume shadow copies via vssadmin, an inhibit-recovery technique used by Snatch and many other ransomware families to prevent victims from restoring encrypted files. Legitimate administrative shadow copy deletion exists but is uncommon on endpoints. Combined with other ransomware indicators this behavior is high fidelity.

Malicious DragonForce Shadow Copy Deletion via Native Utilities (via process_creation)

This rule detects deletion of Volume Shadow Copies through vssadmin, wmic or PowerShell cmdlets used to inhibit recovery before encryption. DragonForce ransomware operators run these native utilities to remove backups so victims cannot restore files, maximizing extortion pressure.

Suspicious Shadow Copy Deletion via WMIC or PowerShell (via process_creation)

This rule detects deletion of Volume Shadow Copies via wmic or PowerShell referencing the shadowcopy class with a delete operation. VanHelsing removes shadow copies before encryption to inhibit recovery, so this command pattern flags pre-ransomware impact activity.

Malicious Volume Shadow Copy Deletion via BlackSuit Ransomware

This rule detects deletion of volume shadow copies through vssadmin, wmic, or PowerShell as seen in BlackSuit ransomware operations. Adversaries remove shadow copies to inhibit system recovery immediately before file encryption, so this activity is a strong indicator of imminent ransomware impact.

Malicious Volume Shadow Copy Deletion via WMI PowerShell

This rule detects PowerShell that enumerates Win32_Shadowcopy objects and pipes them to Remove-WmiObject to destroy volume shadow copies, an inhibit-recovery step preceding encryption. This behavior was observed in RMM-enabled intrusions leading to Akira ransomware. Removing shadow copies denies victims local recovery and signals imminent ransomware detonation.

Malicious Volume Shadow Copy Deletion via PowerShell Child Process via process_creation

This rule detects PowerShell spawning vssadmin, wmic, or WMI calls that delete volume shadow copies. NightSpire ransomware used a PowerShell child process to remove shadow copies and inhibit recovery before encryption, so this behavior is a high-confidence precursor to ransomware impact.

Malicious Shadow Copy Deletion via Vssadmin Quiet

This rule detects vssadmin deleting all shadow copies quietly, an inhibit-recovery action executed before encryption to prevent restore. This was observed during Obscura ransomware deployment. Silent removal of shadow copies denies victims local recovery and confirms destructive intent.

Malicious Registry Hive Theft from Shadow Copy via Print LOLBIN

This rule detects print.exe copying files from a volume shadow copy device path referencing GLOBALROOT, HarddiskVolumeShadowCopy, or a @GMT snapshot UNC path, a LOLBIN abuse technique documented by Huntress for stealing SAM and SYSTEM hives. Attackers use the print utility to read locked credential stores from a shadow copy without triggering hive-export tooling. This file-copy pattern via print.exe is highly anomalous and indicates credential-store theft.

Malicious Volume Shadow Copy Access via Mklink to GLOBALROOT

This rule detects creation of a symbolic link into a GLOBALROOT HarddiskVolumeShadowCopy device path, a technique Huntress observed for reading locked files such as SAM, SYSTEM, and NTDS.DIT from a volume shadow copy. Attackers use the shadow copy to bypass file locks and exfiltrate credential stores. Linking to a shadow copy device object is anomalous and indicates credential-store access.

Malicious Shadow Copy Deletion via WMIC by DragonForce Ransomware (via process_creation)

This rule detects WMIC invoking shadowcopy delete to destroy Volume Shadow Copies, an inhibit-recovery step performed by DragonForce ransomware prior to file encryption. Removing shadow copies prevents victims from restoring data without paying. Detecting this command provides a high-fidelity late-stage ransomware indicator.

Malicious Shadow Copy Deletion via PowerShell Win32_ShadowCopy Remove-CimInstance (via process_creation)

This rule detects PowerShell deleting Volume Shadow Copies by pairing Get-CimInstance Win32_ShadowCopy with Remove-CimInstance, a recovery-inhibition command used by RansomHub per Group-IB. Adversaries remove shadow copies through CIM to block restoration before encryption, making this a strong pre-impact indicator.

Malicious Shadow Copy and Backup Deletion via vssadmin wmic and wbadmin (via process_creation)

This rule detects deletion of Volume Shadow Copies and system backups through vssadmin delete shadows, wmic shadowcopy delete and wbadmin delete commands used by the Hunters International ransomware group per Group-IB. Adversaries remove these recovery points to prevent restoration before encrypting data, so this activity is a strong indicator of imminent ransomware impact.

Malicious Volume Shadow Copy Deletion via Vssadmin

This rule detects vssadmin deleting all volume shadow copies quietly which Eldorado ransomware runs to inhibit system restore before encryption. Removing shadow copies prevents victims from recovering files without paying the ransom. It is important because shadow copy deletion is a reliable pre-encryption impact indicator.