Deletion of Volume Shadow Copies via WMI with PowerShell

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Sigma rule (View on GitHub)

 1title: Deletion of Volume Shadow Copies via WMI with PowerShell
 2id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40
 3related:
 4    - id: e17121b4-ef2a-4418-8a59-12fb1631fa9e
 5      type: derived
 6    - id: c1337eb8-921a-4b59-855b-4ba188ddcc42
 7      type: similar
 8status: test
 9description: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
10references:
11    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
12    - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
13author: Tim Rauch, Elastic (idea)
14date: 2022/09/20
15modified: 2022/12/30
16tags:
17    - attack.impact
18    - attack.t1490
19logsource:
20    category: process_creation
21    product: windows
22detection:
23    selection_get:
24        CommandLine|contains:
25            - 'Get-WmiObject'
26            - 'gwmi'
27            - 'Get-CimInstance'
28            - 'gcim'
29    selection_shadowcopy:
30        CommandLine|contains: 'Win32_Shadowcopy'
31    selection_delete:
32        CommandLine|contains:
33            - '.Delete()'
34            - 'Remove-WmiObject'
35            - 'rwmi'
36            - 'Remove-CimInstance'
37            - 'rcim'
38    condition: all of selection*
39falsepositives:
40    - Unknown
41level: high

References

Related rules

to-top