Inhibit System Recovery — Shadow Copy and Backup Catalog Deletion via vssadmin/wbadmin/wmic

let Lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where (
    (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete" and ProcessCommandLine has "shadow")
    or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete" and (ProcessCommandLine has "catalog" or ProcessCommandLine has "systemstatebackup" or ProcessCommandLine has "backup"))
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled" and ProcessCommandLine has "no")
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "bootstatuspolicy" and ProcessCommandLine has "ignoreallfailures")
    or (FileName =~ "powershell.exe" and ProcessCommandLine has "Win32_ShadowCopy" and ProcessCommandLine has "Delete")
)
| extend Technique = case(
    FileName =~ "vssadmin.exe", "vssadmin_delete_shadows",
    FileName =~ "wmic.exe", "wmic_shadowcopy_delete",
    FileName =~ "wbadmin.exe", "wbadmin_delete_catalog_or_backup",
    FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled", "bcdedit_disable_recovery",
    FileName =~ "bcdedit.exe", "bcdedit_ignore_boot_failures",
    "powershell_wmi_shadowcopy_delete"
)
| extend RiskScore = iff(Technique in ("vssadmin_delete_shadows", "wmic_shadowcopy_delete", "wbadmin_delete_catalog_or_backup"), 95, 80)
| summarize Commands = make_set(Technique), Events = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), MaxRisk = max(RiskScore) by DeviceName, AccountName, bin(Timestamp, 30m)
| project FirstSeen, LastSeen, DeviceName, AccountName, Events, Commands, MaxRisk
| sort by MaxRisk desc, LastSeen desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  (Image="*\\vssadmin.exe" CommandLine="*delete*" CommandLine="*shadow*")
  OR (Image="*\\wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*")
  OR (Image="*\\wbadmin.exe" CommandLine="*delete*" (CommandLine="*catalog*" OR CommandLine="*systemstatebackup*" OR CommandLine="*backup*"))
  OR (Image="*\\bcdedit.exe" CommandLine="*recoveryenabled*" CommandLine="*no*")
  OR (Image="*\\bcdedit.exe" CommandLine="*bootstatuspolicy*" CommandLine="*ignoreallfailures*")
  OR (Image="*\\powershell.exe" CommandLine="*Win32_ShadowCopy*" CommandLine="*Delete*")
)
| eval Technique=case(
    match(Image, "(?i)vssadmin"), "vssadmin_delete_shadows",
    match(Image, "(?i)wmic"), "wmic_shadowcopy_delete",
    match(Image, "(?i)wbadmin"), "wbadmin_delete_catalog_or_backup",
    match(Image, "(?i)bcdedit") AND match(CommandLine, "(?i)recoveryenabled"), "bcdedit_disable_recovery",
    match(Image, "(?i)bcdedit"), "bcdedit_ignore_boot_failures",
    true(), "powershell_wmi_shadowcopy_delete"
  )
| eval RiskScore=if(Technique IN ("vssadmin_delete_shadows","wmic_shadowcopy_delete","wbadmin_delete_catalog_or_backup"), 95, 80)
| bin _time span=30m
| stats count as Events, values(Technique) as Commands, max(RiskScore) as MaxRisk by host, User, _time
| sort - MaxRisk, - Events

process where event.type == "start" and (
  (process.name : "vssadmin.exe" and process.command_line : "*delete*" and process.command_line : "*shadow*") or
  (process.name : "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
  (process.name : "wbadmin.exe" and process.command_line : "*delete*" and (process.command_line : "*catalog*" or process.command_line : "*systemstatebackup*" or process.command_line : "*backup*")) or
  (process.name : "bcdedit.exe" and process.command_line : "*recoveryenabled*" and process.command_line : "*no*") or
  (process.name : "bcdedit.exe" and process.command_line : "*bootstatuspolicy*" and process.command_line : "*ignoreallfailures*") or
  (process.name : "powershell.exe" and process.command_line : "*Win32_ShadowCopy*" and process.command_line : "*Delete*")
)

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  "Process Name" AS ProcessName,
  "Process Command Line" AS CommandLine,
  UserName,
  sourceip AS SourceIP,
  CASE
    WHEN "Process Name" ILIKE '%vssadmin%' AND "Process Command Line" ILIKE '%delete%' AND "Process Command Line" ILIKE '%shadow%' THEN 'vssadmin_delete_shadows'
    WHEN "Process Name" ILIKE '%wmic%' AND "Process Command Line" ILIKE '%shadowcopy%' AND "Process Command Line" ILIKE '%delete%' THEN 'wmic_shadowcopy_delete'
    WHEN "Process Name" ILIKE '%wbadmin%' AND "Process Command Line" ILIKE '%delete%' THEN 'wbadmin_delete_catalog_or_backup'
    WHEN "Process Name" ILIKE '%bcdedit%' AND "Process Command Line" ILIKE '%recoveryenabled%' THEN 'bcdedit_disable_recovery'
    WHEN "Process Name" ILIKE '%bcdedit%' AND "Process Command Line" ILIKE '%bootstatuspolicy%' THEN 'bcdedit_ignore_boot_failures'
    ELSE 'Other'
  END AS Technique
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) ILIKE '%Sysmon%' OR LOGSOURCETYPENAME(logsourceid) ILIKE '%Microsoft Windows%'
  AND (
    ("Process Name" ILIKE '%vssadmin%' AND "Process Command Line" ILIKE '%delete%shadow%')
    OR ("Process Name" ILIKE '%wmic%' AND "Process Command Line" ILIKE '%shadowcopy%delete%')
    OR ("Process Name" ILIKE '%wbadmin%' AND "Process Command Line" ILIKE '%delete%')
    OR ("Process Name" ILIKE '%bcdedit%' AND ("Process Command Line" ILIKE '%recoveryenabled%' OR "Process Command Line" ILIKE '%bootstatuspolicy%'))
  )
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory="windows/sysmon" EventID=1
(
  (Image="*vssadmin.exe" and CommandLine matches "*delete*" and CommandLine matches "*shadow*")
  or (Image="*wmic.exe" and CommandLine matches "*shadowcopy*" and CommandLine matches "*delete*")
  or (Image="*wbadmin.exe" and CommandLine matches "*delete*")
  or (Image="*bcdedit.exe" and CommandLine matches "*recoveryenabled*")
  or (Image="*bcdedit.exe" and CommandLine matches "*bootstatuspolicy*")
)
| eval Technique = if(Image matches "*vssadmin*", "vssadmin_delete_shadows",
    if(Image matches "*wmic*", "wmic_shadowcopy_delete",
    if(Image matches "*wbadmin*", "wbadmin_delete_catalog_or_backup", "bcdedit_recovery_tamper")))
| timeslice 30m
| stats count as Events, values(Technique) as Techniques by Computer, User, _timeslice
| where Events >= 1
| sort by Events desc

rule vss_shadow_copy_and_backup_catalog_deletion {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects vssadmin/wmic/wbadmin/bcdedit shadow copy and backup catalog deletion consistent with pre-ransomware recovery denial"
    reference = "https://attack.mitre.org/techniques/T1490/"
    severity = "CRITICAL"
    priority = "HIGH"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1490"
    false_positives = "Scheduled backup maintenance, manual shadow copy cleanup, golden-image bcdedit tuning"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (re.regex($e.target.process.file.full_path, `(?i)vssadmin\.exe`) and re.regex($e.target.process.command_line, `(?i)delete.*shadow`)) or
      (re.regex($e.target.process.file.full_path, `(?i)wmic\.exe`) and re.regex($e.target.process.command_line, `(?i)shadowcopy.*delete`)) or
      (re.regex($e.target.process.file.full_path, `(?i)wbadmin\.exe`) and re.regex($e.target.process.command_line, `(?i)delete.*(catalog|systemstatebackup|backup)`)) or
      (re.regex($e.target.process.file.full_path, `(?i)bcdedit\.exe`) and re.regex($e.target.process.command_line, `(?i)(recoveryenabled\s+no|bootstatuspolicy\s+ignoreallfailures)`))
    )
    $host = $e.principal.hostname

  match:
    $host over 30m

  condition:
    $e
}

#event_simpleName=ProcessRollup2
(
  (FileName=/^vssadmin\.exe$/i CommandLine=/delete.*shadow/i) OR
  (FileName=/^wmic\.exe$/i CommandLine=/shadowcopy.*delete/i) OR
  (FileName=/^wbadmin\.exe$/i CommandLine=/delete.*(catalog|systemstatebackup|backup)/i) OR
  (FileName=/^bcdedit\.exe$/i CommandLine=/(recoveryenabled\s+no|bootstatuspolicy\s+ignoreallfailures)/i)
)
| Technique := case([
    FileName=/^vssadmin\.exe$/i, "vssadmin_delete_shadows";
    FileName=/^wmic\.exe$/i, "wmic_shadowcopy_delete";
    FileName=/^wbadmin\.exe$/i, "wbadmin_delete_catalog_or_backup";
    FileName=/^bcdedit\.exe$/i, "bcdedit_recovery_tamper";
    true(), "Other"
  ])
| groupBy([ComputerName, UserName], function=[count(as=Events), collect(Technique, limit=20)])
| sort(Events, order=desc)