Volume Shadow Copy Deletion via PowerShell

  1[metadata]
  2creation_date = "2021/07/19"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic", "Austin Songer"]
  9description = """
 10Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly
 11occurs in tandem with ransomware or other destructive attacks.
 12"""
 13from = "now-9m"
 14index = [
 15    "endgame-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-endpoint.events.process-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-system.security*",
 21    "logs-windows.forwarded*",
 22    "logs-windows.sysmon_operational-*",
 23    "winlogbeat-*",
 24]
 25language = "eql"
 26license = "Elastic License v2"
 27name = "Volume Shadow Copy Deletion via PowerShell"
 28references = [
 29    "https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi/win32-shadowcopy",
 30    "https://powershell.one/wmi/root/cimv2/win32_shadowcopy",
 31    "https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods",
 32]
 33risk_score = 73
 34rule_id = "d99a037b-c8e2-47a5-97b9-170d076827c4"
 35severity = "high"
 36tags = [
 37    "Domain: Endpoint",
 38    "OS: Windows",
 39    "Use Case: Threat Detection",
 40    "Tactic: Impact",
 41    "Resources: Investigation Guide",
 42    "Data Source: Elastic Endgame",
 43    "Data Source: Elastic Defend",
 44    "Data Source: Windows Security Event Logs",
 45    "Data Source: Microsoft Defender XDR",
 46    "Data Source: Sysmon",
 47    "Data Source: SentinelOne",
 48    "Data Source: Crowdstrike",
 49    "Noise: Medium",
 50    "Performance: Normal",
 51    "Profile: Recommended",
 52    "Threat: Ransomware",
 53    "Rule Type: Event Correlation (EQL)",
 54    "Platform: Windows",
 55]
 56timestamp_override = "event.ingested"
 57type = "eql"
 58
 59query = '''
 60process where host.os.type == "windows" and event.type == "start" and
 61  process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
 62  process.args : ("*Get-WmiObject*", "*gwmi*", "*Get-CimInstance*", "*gcim*") and
 63  process.args : ("*Win32_ShadowCopy*") and
 64  process.args : ("*.Delete()*", "*Remove-WmiObject*", "*rwmi*", "*Remove-CimInstance*", "*rcim*")
 65'''
 66
 67note = """## Triage and analysis
 68
 69### Investigating Volume Shadow Copy Deletion via PowerShell
 70
 71#### Possible investigation steps
 72
 73- Does the alert-local PowerShell command show broad shadow-copy deletion, remote targeting, or obscured execution?
 74  - Focus: `process.command_line`, checking whether "Win32_ShadowCopy" is paired with WMI or CIM enumeration and deletion.
 75  - Hint: treat `Get-WmiObject`, `gwmi`, `Get-CimInstance`, `gcim`, `Remove-WmiObject`, `rwmi`, `Remove-CimInstance`, `rcim`, "$_.Delete()", `-ComputerName`, and `-CimSession` as high-signal command cues. This rule requires plaintext cmdlet tokens in `process.args`; fully encoded commands or script-file invocations that hide the deletion logic will not fire this rule.
 76  - Implication: escalate when the command deletes all returned shadow-copy instances, targets remote systems, or hides WMI or CIM deletion behind aliases; lower suspicion only when narrowly scoped to one recognized backup-retention, image-reset, or lab-test workflow on the expected host.
 77
 78- Is the PowerShell host binary expected rather than renamed or tampered?
 79  - Focus: `process.executable`, `process.name`, `process.pe.original_file_name`, `process.code_signature.subject_name`, and `process.code_signature.trusted`.
 80  - Implication: escalate when path, signer, trust state, or original file name does not match the expected PowerShell host; lower suspicion when identity matches a trusted system PowerShell installation, but continue because legitimate PowerShell can still delete recovery points.
 81
 82- Does the parent process and user context explain why this host removed shadow copies?
 83  - Focus: `process.parent.executable`, `process.parent.command_line`, `user.id`, `user.name`, and `user.domain`.
 84  - Implication: escalate when Office, a browser, a script host, an unexpected remote-management chain, or a standard user launches deletion; lower suspicion when parent, account, and host match a recognized backup, imaging, disaster-recovery, or lab-reset workflow.
 85
 86- Do surrounding process events show recovery inhibition or ransomware preparation from the same host or lineage?
 87  - Why: ransomware commonly pairs shadow-copy deletion with other recovery removal or encryption preparation before impact.
 88  - Focus: process starts on `host.id` and, when present, the same `process.entity_id` or lineage, using `process.name`, `process.command_line`, and `process.parent.executable`. $investigate_0
 89  - Range: start with the alert window and following 15 minutes; expand only when the same lineage shows recovery tampering or encryption behavior.
 90  - Implication: escalate when the same window shows `vssadmin`, `wmic`, `diskshadow`, `wbadmin`, backup service stops, recovery-setting changes, or likely encryptor launchers; lower suspicion when activity stays bounded to the same parent-launched cleanup or reset sequence and no other recovery-inhibition utilities appear.
 91
 92- If command or lineage remains suspicious and endpoint file telemetry is available, does file activity show encryption or destructive cleanup?
 93  - Focus: recover file events with `host.id` + `process.entity_id`; if absent, use `host.id` + `process.pid` plus a tight alert window as a weaker fallback, then review `file.path`, `file.extension`, and `file.Ext.original.extension`. $investigate_1
 94  - Implication: escalate when recovered file events show mass renames, unfamiliar extensions, replaced user files, or ransom-note paths after deletion; lower suspicion only when changes stay inside the recovered backup or reset target. Missing endpoint file telemetry leaves file impact unanswered; do not treat absence of file evidence as benign.
 95
 96- If local evidence remains suspicious or unresolved, does related alerting show the same VSS deletion or backup-tampering pattern?
 97  - Focus: related impact or execution alerts for the same `user.id` involving VSS deletion, backup tampering, credential access, or the same parent tool. $investigate_2
 98  - Hint: check the same `host.id` for shadow-copy deletion by other binaries, encryption, ransom-note creation, backup tampering, or service tampering. $investigate_3
 99  - Implication: expand scope when the same user touches multiple hosts or the same host shows a broader ransomware chain; keep the case local only when related alerts are absent and local telemetry already fits one recognized workflow.
100
101- Escalate broad or remote shadow-copy deletion that lacks a recognized workflow, has suspicious lineage, destructive process or file evidence, or related spread; close only when narrow command scope, identity, lineage, and supported surrounding telemetry fit one workflow; preserve and escalate mixed or visibility-limited evidence.
102
103### False positive analysis
104
105- PowerShell WMI or CIM shadow-copy deletion is suspicious by default outside controlled backup-retention cleanup, disaster-recovery testing, gold-image preparation, lab reset, or ransomware simulation. Close as benign only when `process.command_line` is narrowly scoped, `process.parent.executable` matches the backup, orchestration, reset, or test tool, `user.id` or `user.name` matches the expected admin or service account, `host.id` plus `host.name` fit the target, and surrounding telemetry shows no destructive process or file impact. Use change records or lab schedules only as corroboration; generic storage maintenance is not enough.
106- Before creating an exception, validate historical stability for the same `process.executable`, `process.parent.executable`, stable `process.command_line` scope, `user.id` or `user.name`, and `host.id`. Build the exception from that minimum confirmed workflow pattern. Avoid exceptions on "powershell.exe", `process.name`, or "Win32_ShadowCopy" alone.
107
108### Response and remediation
109
110- If confirmed benign, reverse any temporary containment and record the `process.command_line`, `process.parent.executable`, `user.id` or `user.name`, `host.id`, and maintenance evidence that proved the workflow. Create an exception only if the same command scope, lineage, account, and host recur consistently across prior alerts from this rule.
111- If suspicious but unconfirmed, preserve the alert, `process.entity_id`, full `process.command_line`, `process.args`, parent chain, `user.id`, `user.name`, `host.id`, surrounding process commands, and any recovered file-impact examples before containment. Apply reversible containment first: isolate the host only when destructive process or file evidence suggests ongoing impact and the host can tolerate isolation; otherwise restrict the implicated admin channel or account while scope is confirmed. Expand containment to related hosts or accounts only if the same-user or same-host pivots show spread.
112- If confirmed malicious, preserve the same process, command, lineage, and recovered file-impact artifacts before destructive action. Prefer endpoint isolation to stop further impact while keeping telemetry available; if direct response is unavailable, escalate with the preserved `host.id`, `user.id`, `user.name`, `process.entity_id`, `process.command_line`, and suspected ransom-note or renamed-extension indicators to the team that can isolate the host and suspend related accounts or services. If the malicious process chain is still active, record `process.entity_id` and `process.command_line` before suspending or terminating it.
113- After scope review, remove only the malicious scripts, scheduled tasks, services, payloads, or dropped notes identified during the investigation, then restore affected backup or recovery settings and validate that snapshots or backup jobs are functioning before closure.
114- Post-incident hardening: restrict VSS-management workflows and remote CIM deletion patterns to controlled administrative channels, retain the process and file telemetry that proved the case, and review whether adjacent VSS methods such as "vssadmin", "wmic", `diskshadow`, `wbadmin`, COM-based deletion, or diff-area resizing need the same controls.
115"""
116
117setup = """## Setup
118
119This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
120
121Setup instructions: https://ela.st/install-elastic-defend
122
123### Additional data sources
124
125This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
126
127- [CrowdStrike](https://ela.st/crowdstrike-integration)
128- [Microsoft Defender XDR](https://ela.st/m365-defender)
129- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
130- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
131- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
132"""
133
134[rule.investigation_fields]
135field_names = [
136    "@timestamp",
137    "host.id",
138    "user.id",
139    "process.entity_id",
140    "process.pid",
141    "process.executable",
142    "process.pe.original_file_name",
143    "process.command_line",
144    "process.args",
145    "process.parent.entity_id",
146    "process.parent.pid",
147    "process.parent.executable",
148    "process.parent.command_line",
149    "process.code_signature.subject_name",
150    "process.code_signature.trusted",
151]
152
153[transform]
154
155[[transform.investigate]]
156label = "Process starts on the same host"
157description = ""
158providers = [
159  [
160    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
161    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
162    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
163  ],
164  [
165    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
166    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" },
167    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
168    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
169  ]
170]
171relativeFrom = "now-1h"
172relativeTo = "now"
173
174[[transform.investigate]]
175label = "File events from the PowerShell process"
176description = ""
177providers = [
178  [
179    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
180    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
181    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
182  ],
183  [
184    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
185    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
186    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
187  ]
188]
189relativeFrom = "now-1h"
190relativeTo = "now"
191
192[[transform.investigate]]
193label = "Alerts associated with the user"
194description = ""
195providers = [
196  [
197    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
198    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
199  ]
200]
201relativeFrom = "now-48h/h"
202relativeTo = "now"
203
204[[transform.investigate]]
205label = "Alerts associated with the host"
206description = ""
207providers = [
208  [
209    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
210    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
211  ]
212]
213relativeFrom = "now-48h/h"
214relativeTo = "now"
215
216[[rule.threat]]
217framework = "MITRE ATT&CK"
218
219[[rule.threat.technique]]
220id = "T1490"
221name = "Inhibit System Recovery"
222reference = "https://attack.mitre.org/techniques/T1490/"
223
224[rule.threat.tactic]
225id = "TA0040"
226name = "Impact"
227reference = "https://attack.mitre.org/tactics/TA0040/"
228
229[[rule.threat]]
230framework = "MITRE ATT&CK"
231
232[[rule.threat.technique]]
233id = "T1047"
234name = "Windows Management Instrumentation"
235reference = "https://attack.mitre.org/techniques/T1047/"
236
237[[rule.threat.technique]]
238id = "T1059"
239name = "Command and Scripting Interpreter"
240reference = "https://attack.mitre.org/techniques/T1059/"
241
242[[rule.threat.technique.subtechnique]]
243id = "T1059.001"
244name = "PowerShell"
245reference = "https://attack.mitre.org/techniques/T1059/001/"
246
247[rule.threat.tactic]
248id = "TA0002"
249name = "Execution"
250reference = "https://attack.mitre.org/tactics/TA0002/"