Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-VSSShadowCopyDeletion.
Unlock with Pro - from £29/user/moDetect Shadow Copy and Backup Catalog Deletion via vssadmin/wbadmin/wmic in Elastic Security
Deleting Volume Shadow Copies and local Windows Server Backup catalogs is one of the most consistent pre-encryption steps observed across ransomware operators, because it removes the victim's fastest and cheapest recovery path before file encryption begins. Attackers who have already escalated privileges typically run one or more of: `vssadmin delete shadows /all /quiet` (bulk-deletes all shadow copies on all volumes, silently), `wmic shadowcopy delete` (the WMI equivalent, often used because vssadmin can be blocked by application allowlisting while wmic is overlooked), `wbadmin delete catalog -quiet` or `wbadmin delete systemstatebackup` (removes the local Windows Server Backup catalog and system-state backups so `wbadmin` itself can no longer be used to restore), and `bcdedit /set {default} recoveryenabled no` combined with `bcdedit /set {default} bootstatuspolicy ignoreallfailures` (disables the Windows Recovery Environment and automatic repair so a damaged/encrypted boot volume cannot self-heal). These four commands appear near-verbatim in incident reports for LockBit, Akira, Black Basta, BlackCat/ALPHV, Conti, and Ryuk, frequently chained together in a single batch script or PowerShell one-liner and executed seconds to minutes before the encryptor binary runs. The commands are legitimate, signed Windows administration utilities (LOLBins), so detection must key on the destructive argument combinations (bulk `delete shadows /all`, `shadowcopy delete`, `delete catalog`/`delete systemstatebackup`, `recoveryenabled no`) rather than on the binaries themselves, and correlate bursts of these commands across short windows and/or multiple hosts as the highest-confidence signal of an imminent or in-progress ransomware detonation.
MITRE ATT&CK
- Tactic
- Impact
Elastic Detection Query
process where event.type == "start" and (
(process.name : "vssadmin.exe" and process.command_line : "*delete*" and process.command_line : "*shadow*") or
(process.name : "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
(process.name : "wbadmin.exe" and process.command_line : "*delete*" and (process.command_line : "*catalog*" or process.command_line : "*systemstatebackup*" or process.command_line : "*backup*")) or
(process.name : "bcdedit.exe" and process.command_line : "*recoveryenabled*" and process.command_line : "*no*") or
(process.name : "bcdedit.exe" and process.command_line : "*bootstatuspolicy*" and process.command_line : "*ignoreallfailures*") or
(process.name : "powershell.exe" and process.command_line : "*Win32_ShadowCopy*" and process.command_line : "*Delete*")
)Elastic EQL process-start query matching the same recovery-inhibition command set: vssadmin bulk shadow-copy deletion, wmic shadowcopy deletion, wbadmin catalog/system-state backup deletion, bcdedit recovery/boot-failure-policy tampering, and the PowerShell WMI shadow-copy deletion variant. Pair with an Elastic detection rule threshold (2+ distinct command types from the same host.name within 30 minutes) to reproduce the multi-command burst scoring used in the KQL/SPL rules.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled backup software pruning shadow copies or rotating the local backup catalog per retention policy
- Administrators manually reclaiming shadow copy storage with vssadmin
- Sysprep/golden-image pipelines adjusting bcdedit recovery/boot settings
- VM/disk imaging tools clearing shadow copy state before capturing a template
Other platforms for THREAT-Impact-VSSShadowCopyDeletion
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Delete All Volume Shadow Copies via vssadmin
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=vssadmin.exe, CommandLine contains 'delete shadows /all /quiet'.
- Test 2Delete Shadow Copies via WMIC
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=wmic.exe, CommandLine contains 'shadowcopy delete'.
- Test 3Delete Local Backup Catalog via wbadmin
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=wbadmin.exe, CommandLine contains 'delete catalog -quiet'.
- Test 4Disable Windows Recovery Environment via bcdedit
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=bcdedit.exe, two events with CommandLine containing 'recoveryenabled no' and 'bootstatuspolicy ignoreallfailures' respectively.
References (7)
- https://attack.mitre.org/techniques/T1490/
- https://attack.mitre.org/tactics/TA0040/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-VSSShadowCopyDeletion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.