Delete Volume Shadow Copies Via WMI With PowerShell

 1title: Delete Volume Shadow Copies Via WMI With PowerShell
 2id: 87df9ee1-5416-453a-8a08-e8d4a51e9ce1
 3status: stable
 4description: Shadow Copies deletion using operating systems utilities via PowerShell
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md
 7    - https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods
 8author: frack113
 9date: 2021-06-03
10modified: 2023-10-27
11tags:
12    - attack.impact
13    - attack.t1490
14logsource:
15    product: windows
16    category: ps_classic_start
17detection:
18    selection:
19        Data|contains|all:
20            - 'Get-WmiObject'
21            - 'Win32_ShadowCopy'
22        Data|contains:
23            - 'Delete()'
24            - 'Remove-WmiObject'
25    condition: selection
26falsepositives:
27    - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
28level: high

References

• atomic-red-team/atomics/T1490/T1490.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

  

  Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

  
  Read More

• Stomping Shadow Copies - A Second Look Into Deletion Methods | FortiGuard Labs

  

  FortiGuard Labs reviews existing methods used by various ransomware to delete shadow copies as well as some new methods that can potentially be used by some ransomware.…

  
  Read More

Related rules

• All Backups Deleted Via Wbadmin.EXE
• Backup Files Deleted
• Boot Configuration Tampering Via Bcdedit.EXE
• Cisco Modify Configuration
• Copy From VolumeShadowCopy Via Cmd.EXE