Delete Volume Shadow Copies via WMI with PowerShell - PS Script
Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
Sigma rule (View on GitHub)
1title: Delete Volume Shadow Copies via WMI with PowerShell - PS Script
2id: e17121b4-ef2a-4418-8a59-12fb1631fa9e
3status: test
4description: Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
5references:
6 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
7author: frack113
8date: 2021/12/26
9modified: 2022/12/02
10tags:
11 - attack.impact
12 - attack.t1490
13logsource:
14 product: windows
15 category: ps_script
16 definition: 'Requirements: Script Block Logging must be enabled'
17detection:
18 selection:
19 ScriptBlockText|contains|all:
20 - 'Get-WmiObject'
21 - 'Win32_Shadowcopy'
22 - '.Delete()'
23 condition: selection
24falsepositives:
25 - Unknown
26level: high
References
Related rules
- Boot Configuration Database (BCD) Manipulation - Registry Modification
- Use of bcdedit to Disrupt Boot Processes
- WMIC Shadow Copy Deletion
- Powershell Add Name Resolution Policy Table Rule
- OneLogin User Account Locked