Sigma detection rules, expert-reviewed

Malicious Volume Shadow Copy Deletion via Vssadmin

This rule detects vssadmin deleting all volume shadow copies which the actors in the Sliver and PoshC2 toolkit intrusion ran to inhibit recovery ahead of impact and this matters because deleting every shadow copy removes the primary local restore path and is a defining pre encryption ransomware action rarely performed by legitimate administrators.

Malicious Credential Hive Copy from Volume Shadow Copy

This rule detects a copy command referencing a HarddiskVolumeShadowCopy path together with a credential store name such as SAM, SYSTEM, or ntds.dit, a technique Huntress observed for extracting locked hives from a shadow copy. Attackers duplicate credential databases from the snapshot to bypass file locks before offline cracking. Copying hive files out of a shadow copy is a strong credential-access indicator.

Malicious Shadow Copy and Backup Deletion for Ransomware Recovery Inhibition

This rule detects deletion of volume shadow copies and backup catalogs through vssadmin wmic and wbadmin which Phobos ransomware runs before encryption to prevent victims from restoring their files. Inhibiting system recovery is a common precursor to file encryption and warrants immediate response.

Malicious Inhibit System Recovery via Shadow Copy Deletion and Boot Configuration

This rule detects deletion of volume shadow copies and disabling of Windows recovery via bcdedit which active ransomware families execute before encryption. Observed in NCC Group research into active ransomware families including a BlackCat incident response engagement. Removing recovery options maximizes ransomware impact which makes this a high-confidence pre-encryption indicator.

Malicious Shadow Copy Deletion via Vssadmin (via process_creation)

This rule detects vssadmin deleting all volume shadow copies quietly. DarkWatchMan RAT removes shadow copies to inhibit recovery and hide its activity on the host.

Malicious Volume Shadow Copy Deletion via WMI PowerShell (via process_creation)

This rule detects PowerShell querying the Win32_Shadowcopy WMI class and invoking a delete or remove operation to destroy volume shadow copies. Akira used this to inhibit system recovery before encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Malicious Volume Shadow Copy Deletion via vssadmin by Medusa Ransomware

This rule detects use of vssadmin to delete all volume shadow copies quietly, matching the inhibit-recovery step performed by Medusa ransomware before encryption per Unit 42. Ransomware wipes shadow copies to prevent victims from restoring files which is a strong pre-encryption indicator of an active ransomware attack.

Malicious Backup and Shadow Copy Destruction via Native Utilities

This rule detects the deletion of volume shadow copies, backup catalogs, and recovery configuration through native Windows utilities, a recovery-inhibition step performed by Hunters International affiliates before encryption. Destroying backups to prevent restoration is a hallmark of ransomware impact activity and should be treated as high priority.

Malicious Volume Shadow Copy Deletion via vssadmin by RA World

This rule detects deletion of all volume shadow copies through vssadmin, an inhibit-recovery action the RA World ransomware group performs to prevent victims from restoring encrypted files. Destroying shadow copies is a hallmark of ransomware staging. Detecting this exposes imminent or in-progress encryption impact on the host.

Malicious NTDS Credential Theft via Volume Shadow Copy via process_creation

This rule detects volume shadow copy creation with vssadmin or direct references to the ntds.dit Active Directory database used to steal domain credentials. Stately Taurus used vssadmin and NTDS.dit access on a compromised domain controller to harvest the credential store, a high-confidence sign of domain-wide credential access.

Malicious Recovery Inhibition via Shadow Copy and WinRE Tampering

This rule detects command lines that delete Volume Shadow Copies with vssadmin or disable the Windows Recovery Environment with reagentc, actions used by NOVABLIGHT to prevent system and file recovery. Inhibiting recovery is a common precursor to destructive or extortion activity.

Malicious Shadow Copy Deletion via vssadmin Delete Shadows (via process_creation)

This rule detects vssadmin deleting all volume shadow copies quietly, the inhibit-recovery step in the RansomHub intrusion performed alongside log clearing before encryption. Adversaries destroy shadow copies so victims cannot restore files without paying, so this command outside a maintenance window is a strong pre-encryption impact indicator.

Malicious BitLocker Encryption With Shadow Copy Removal via manage-bde (via process_creation)

This rule detects manage-bde being used to turn on BitLocker encryption while removing volume shadow copies in a single operation. This tradecraft is used to weaponise the built-in BitLocker feature for ransomware encryption while destroying recovery data. Encrypting volumes and deleting shadow copies denies access to systems and inhibits restoration to extort the victim.

Malicious Shadow Copy Deletion and Recovery Tampering by BabLock Ransomware

This rule detects deletion of volume shadow copies and disabling of Windows recovery, hallmarks of BabLock ransomware pre-encryption activity. The operators run vssadmin Delete Shadows and bcdedit recoveryenabled No to prevent victims restoring their data. This inhibits recovery and maximizes the impact of the encryption stage.

Windows vshadow.exe Proxy Execution via -exec Script/Command

Alerts when vshadow.exe is run with -exec, which can proxy execution of a script or command after shadow copy creation.