Deletion of Volume Shadow Copies via WMI with PowerShell

 1title: Deletion of Volume Shadow Copies via WMI with PowerShell
 2id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40
 3related:
 4    - id: e17121b4-ef2a-4418-8a59-12fb1631fa9e
 5      type: derived
 6    - id: c1337eb8-921a-4b59-855b-4ba188ddcc42
 7      type: similar
 8status: test
 9description: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
10references:
11    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
12    - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
13author: Tim Rauch, Elastic (idea)
14date: 2022-09-20
15modified: 2022-12-30
16tags:
17    - attack.impact
18    - attack.t1490
19logsource:
20    category: process_creation
21    product: windows
22detection:
23    selection_get:
24        CommandLine|contains:
25            - 'Get-WmiObject'
26            - 'gwmi'
27            - 'Get-CimInstance'
28            - 'gcim'
29    selection_shadowcopy:
30        CommandLine|contains: 'Win32_ShadowCopy'
31    selection_delete:
32        CommandLine|contains:
33            - '.Delete()'
34            - 'Remove-WmiObject'
35            - 'rwmi'
36            - 'Remove-CimInstance'
37            - 'rcim'
38    condition: all of selection*
39falsepositives:
40    - Unknown
41level: high

References

• atomic-red-team/atomics/T1490/T1490.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

  

  Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

  
  Read More

• Volume Shadow Copy Deletion via PowerShell | Elastic Security Solution [8.15] | Elastic

  

  Volume Shadow Copy Deletion via PowerShell edit Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware ...

  
  Read More

Related rules

• All Backups Deleted Via Wbadmin.EXE
• Backup Files Deleted
• Boot Configuration Tampering Via Bcdedit.EXE
• Cisco Modify Configuration
• Copy From VolumeShadowCopy Via Cmd.EXE