Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-VSSShadowCopyDeletion.
Unlock with Pro - from £29/user/moDetect Shadow Copy and Backup Catalog Deletion via vssadmin/wbadmin/wmic in IBM QRadar
Deleting Volume Shadow Copies and local Windows Server Backup catalogs is one of the most consistent pre-encryption steps observed across ransomware operators, because it removes the victim's fastest and cheapest recovery path before file encryption begins. Attackers who have already escalated privileges typically run one or more of: `vssadmin delete shadows /all /quiet` (bulk-deletes all shadow copies on all volumes, silently), `wmic shadowcopy delete` (the WMI equivalent, often used because vssadmin can be blocked by application allowlisting while wmic is overlooked), `wbadmin delete catalog -quiet` or `wbadmin delete systemstatebackup` (removes the local Windows Server Backup catalog and system-state backups so `wbadmin` itself can no longer be used to restore), and `bcdedit /set {default} recoveryenabled no` combined with `bcdedit /set {default} bootstatuspolicy ignoreallfailures` (disables the Windows Recovery Environment and automatic repair so a damaged/encrypted boot volume cannot self-heal). These four commands appear near-verbatim in incident reports for LockBit, Akira, Black Basta, BlackCat/ALPHV, Conti, and Ryuk, frequently chained together in a single batch script or PowerShell one-liner and executed seconds to minutes before the encryptor binary runs. The commands are legitimate, signed Windows administration utilities (LOLBins), so detection must key on the destructive argument combinations (bulk `delete shadows /all`, `shadowcopy delete`, `delete catalog`/`delete systemstatebackup`, `recoveryenabled no`) rather than on the binaries themselves, and correlate bursts of these commands across short windows and/or multiple hosts as the highest-confidence signal of an imminent or in-progress ransomware detonation.
MITRE ATT&CK
- Tactic
- Impact
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
"Process Name" AS ProcessName,
"Process Command Line" AS CommandLine,
UserName,
sourceip AS SourceIP,
CASE
WHEN "Process Name" ILIKE '%vssadmin%' AND "Process Command Line" ILIKE '%delete%' AND "Process Command Line" ILIKE '%shadow%' THEN 'vssadmin_delete_shadows'
WHEN "Process Name" ILIKE '%wmic%' AND "Process Command Line" ILIKE '%shadowcopy%' AND "Process Command Line" ILIKE '%delete%' THEN 'wmic_shadowcopy_delete'
WHEN "Process Name" ILIKE '%wbadmin%' AND "Process Command Line" ILIKE '%delete%' THEN 'wbadmin_delete_catalog_or_backup'
WHEN "Process Name" ILIKE '%bcdedit%' AND "Process Command Line" ILIKE '%recoveryenabled%' THEN 'bcdedit_disable_recovery'
WHEN "Process Name" ILIKE '%bcdedit%' AND "Process Command Line" ILIKE '%bootstatuspolicy%' THEN 'bcdedit_ignore_boot_failures'
ELSE 'Other'
END AS Technique
FROM events
WHERE
LOGSOURCETYPENAME(logsourceid) ILIKE '%Sysmon%' OR LOGSOURCETYPENAME(logsourceid) ILIKE '%Microsoft Windows%'
AND (
("Process Name" ILIKE '%vssadmin%' AND "Process Command Line" ILIKE '%delete%shadow%')
OR ("Process Name" ILIKE '%wmic%' AND "Process Command Line" ILIKE '%shadowcopy%delete%')
OR ("Process Name" ILIKE '%wbadmin%' AND "Process Command Line" ILIKE '%delete%')
OR ("Process Name" ILIKE '%bcdedit%' AND ("Process Command Line" ILIKE '%recoveryenabled%' OR "Process Command Line" ILIKE '%bootstatuspolicy%'))
)
ORDER BY starttime DESC
LAST 24 HOURSQRadar AQL query over Sysmon/Windows process-creation events for the recovery-inhibition command set. Recommend a QRadar rule requiring 2+ distinct Technique values from the same UserName/host within 30 minutes to reproduce the multi-command burst pattern that distinguishes ransomware precursor activity from a single routine maintenance command.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled backup software pruning shadow copies or backup catalogs
- Administrators manually reclaiming shadow copy storage
- Golden-image pipelines adjusting bcdedit settings
- VM/disk imaging tools clearing shadow copy state
Other platforms for THREAT-Impact-VSSShadowCopyDeletion
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Delete All Volume Shadow Copies via vssadmin
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=vssadmin.exe, CommandLine contains 'delete shadows /all /quiet'.
- Test 2Delete Shadow Copies via WMIC
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=wmic.exe, CommandLine contains 'shadowcopy delete'.
- Test 3Delete Local Backup Catalog via wbadmin
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=wbadmin.exe, CommandLine contains 'delete catalog -quiet'.
- Test 4Disable Windows Recovery Environment via bcdedit
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=bcdedit.exe, two events with CommandLine containing 'recoveryenabled no' and 'bootstatuspolicy ignoreallfailures' respectively.
References (7)
- https://attack.mitre.org/techniques/T1490/
- https://attack.mitre.org/tactics/TA0040/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-VSSShadowCopyDeletion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.