Detecting Shadow Copy Deletion or Resize
Hypothesis and description
After compromising a network of systems, threat actors often try to delete/resize Shadow Copy in an attempt to prevent administrators from restoring the systems to versions present before the attack. This is often done via vssadmin, a legitimate Windows tool to interact with shadow copies. This action is often employed by ransomware, may lead to a failure in recovering systems after an attack. The pseudo code detection focus on Windows Security and Sysmon process creation (4688 and 1). The use of wmic to delete shadow copy generates WMI-Activity Operationnal 5857 event and could generate 5858 (if the operation fails). These 2 EventIDs could be interesting when attackers use wmic without process creation and/or for forensics.
- Platforms
- Windows
- Domain
- Host
- Subtypes
- Process
- Submitted
- 2020-12-11 (updated 2022-02-03)
- Contributors
- Cyware Labs, Lucas Heiligenstein
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1490 Inhibit System Recovery | Impact | Low |
1 technique. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
This query looks for the deletion or resizing of shadow copy volumes, which may possibly indicate malicious activity.
((EventCode="4688" OR EventCode="1") (CommandLine="*vssadmin* *delete* *shadows*" OR CommandLine="*wmic* *shadowcopy* *delete*" OR CommandLine="*vssadmin* *resize* *shadowstorage*")) OR (EventCode="5857" ProviderName="MSVSS__PROVIDER") OR (EventCode="5858" Operation="*Win32_ShadowCopy*")This query looks for the deletion or resizing of shadow copy volumes, which may possibly indicate malicious activity.
(EventCode:("4688" OR "1") AND process.command_line:(*vssadmin*\ *delete*\ *shadows* OR *wmic*\ *shadowcopy*\ *delete* OR *vssadmin*\ *resize*\ *shadowstorage*)) OR (EventCode:"5857" AND ProviderName:"MSVSS__PROVIDER") OR (EventCode:"5858" AND Operation:*Win32_ShadowCopy*)This query looks for the deletion or resizing of shadow copy volumes, which may possibly indicate malicious activity.
(EventCode IN ["4688", "1"] CommandLine IN ["*vssadmin* *delete* *shadows*", "*wmic* *shadowcopy* *delete*", "*vssadmin* *resize* *shadowstorage*"]) OR (EventCode IN "5857" ProviderName IN "MSVSS__PROVIDER") OR (EventCode IN "5858" Operation IN "*Win32_ShadowCopy*")Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.