Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-VSSShadowCopyDeletion.
Unlock with Pro - from £29/user/moDetect Shadow Copy and Backup Catalog Deletion via vssadmin/wbadmin/wmic in Google Chronicle
Deleting Volume Shadow Copies and local Windows Server Backup catalogs is one of the most consistent pre-encryption steps observed across ransomware operators, because it removes the victim's fastest and cheapest recovery path before file encryption begins. Attackers who have already escalated privileges typically run one or more of: `vssadmin delete shadows /all /quiet` (bulk-deletes all shadow copies on all volumes, silently), `wmic shadowcopy delete` (the WMI equivalent, often used because vssadmin can be blocked by application allowlisting while wmic is overlooked), `wbadmin delete catalog -quiet` or `wbadmin delete systemstatebackup` (removes the local Windows Server Backup catalog and system-state backups so `wbadmin` itself can no longer be used to restore), and `bcdedit /set {default} recoveryenabled no` combined with `bcdedit /set {default} bootstatuspolicy ignoreallfailures` (disables the Windows Recovery Environment and automatic repair so a damaged/encrypted boot volume cannot self-heal). These four commands appear near-verbatim in incident reports for LockBit, Akira, Black Basta, BlackCat/ALPHV, Conti, and Ryuk, frequently chained together in a single batch script or PowerShell one-liner and executed seconds to minutes before the encryptor binary runs. The commands are legitimate, signed Windows administration utilities (LOLBins), so detection must key on the destructive argument combinations (bulk `delete shadows /all`, `shadowcopy delete`, `delete catalog`/`delete systemstatebackup`, `recoveryenabled no`) rather than on the binaries themselves, and correlate bursts of these commands across short windows and/or multiple hosts as the highest-confidence signal of an imminent or in-progress ransomware detonation.
MITRE ATT&CK
- Tactic
- Impact
YARA-L Detection Query
rule vss_shadow_copy_and_backup_catalog_deletion {
meta:
author = "df00tech Detection Engineering"
description = "Detects vssadmin/wmic/wbadmin/bcdedit shadow copy and backup catalog deletion consistent with pre-ransomware recovery denial"
reference = "https://attack.mitre.org/techniques/T1490/"
severity = "CRITICAL"
priority = "HIGH"
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1490"
false_positives = "Scheduled backup maintenance, manual shadow copy cleanup, golden-image bcdedit tuning"
version = "1.0"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
(
(re.regex($e.target.process.file.full_path, `(?i)vssadmin\.exe`) and re.regex($e.target.process.command_line, `(?i)delete.*shadow`)) or
(re.regex($e.target.process.file.full_path, `(?i)wmic\.exe`) and re.regex($e.target.process.command_line, `(?i)shadowcopy.*delete`)) or
(re.regex($e.target.process.file.full_path, `(?i)wbadmin\.exe`) and re.regex($e.target.process.command_line, `(?i)delete.*(catalog|systemstatebackup|backup)`)) or
(re.regex($e.target.process.file.full_path, `(?i)bcdedit\.exe`) and re.regex($e.target.process.command_line, `(?i)(recoveryenabled\s+no|bootstatuspolicy\s+ignoreallfailures)`))
)
$host = $e.principal.hostname
match:
$host over 30m
condition:
$e
}Chronicle YARA-L 2.0 rule matching PROCESS_LAUNCH UDM events for the recovery-inhibition command set. Fires on vssadmin bulk shadow-copy deletion, wmic shadowcopy deletion, wbadmin catalog/system-state backup deletion, and bcdedit recovery/boot-failure-policy tampering, grouped by hostname over a 30-minute window to surface the multi-command burst pattern typical of a ransomware precursor script.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled backup maintenance jobs pruning shadow copies or backup catalogs
- Administrators manually reclaiming shadow copy storage
- Golden-image pipelines adjusting bcdedit settings
- VM/disk imaging tools clearing shadow copy state
Other platforms for THREAT-Impact-VSSShadowCopyDeletion
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Delete All Volume Shadow Copies via vssadmin
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=vssadmin.exe, CommandLine contains 'delete shadows /all /quiet'.
- Test 2Delete Shadow Copies via WMIC
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=wmic.exe, CommandLine contains 'shadowcopy delete'.
- Test 3Delete Local Backup Catalog via wbadmin
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=wbadmin.exe, CommandLine contains 'delete catalog -quiet'.
- Test 4Disable Windows Recovery Environment via bcdedit
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=bcdedit.exe, two events with CommandLine containing 'recoveryenabled no' and 'bootstatuspolicy ignoreallfailures' respectively.
References (7)
- https://attack.mitre.org/techniques/T1490/
- https://attack.mitre.org/tactics/TA0040/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-VSSShadowCopyDeletion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.