Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-VSSShadowCopyDeletion.
Unlock with Pro - from £29/user/moDetect Shadow Copy and Backup Catalog Deletion via vssadmin/wbadmin/wmic in Splunk
Deleting Volume Shadow Copies and local Windows Server Backup catalogs is one of the most consistent pre-encryption steps observed across ransomware operators, because it removes the victim's fastest and cheapest recovery path before file encryption begins. Attackers who have already escalated privileges typically run one or more of: `vssadmin delete shadows /all /quiet` (bulk-deletes all shadow copies on all volumes, silently), `wmic shadowcopy delete` (the WMI equivalent, often used because vssadmin can be blocked by application allowlisting while wmic is overlooked), `wbadmin delete catalog -quiet` or `wbadmin delete systemstatebackup` (removes the local Windows Server Backup catalog and system-state backups so `wbadmin` itself can no longer be used to restore), and `bcdedit /set {default} recoveryenabled no` combined with `bcdedit /set {default} bootstatuspolicy ignoreallfailures` (disables the Windows Recovery Environment and automatic repair so a damaged/encrypted boot volume cannot self-heal). These four commands appear near-verbatim in incident reports for LockBit, Akira, Black Basta, BlackCat/ALPHV, Conti, and Ryuk, frequently chained together in a single batch script or PowerShell one-liner and executed seconds to minutes before the encryptor binary runs. The commands are legitimate, signed Windows administration utilities (LOLBins), so detection must key on the destructive argument combinations (bulk `delete shadows /all`, `shadowcopy delete`, `delete catalog`/`delete systemstatebackup`, `recoveryenabled no`) rather than on the binaries themselves, and correlate bursts of these commands across short windows and/or multiple hosts as the highest-confidence signal of an imminent or in-progress ransomware detonation.
MITRE ATT&CK
- Tactic
- Impact
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
(Image="*\\vssadmin.exe" CommandLine="*delete*" CommandLine="*shadow*")
OR (Image="*\\wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*")
OR (Image="*\\wbadmin.exe" CommandLine="*delete*" (CommandLine="*catalog*" OR CommandLine="*systemstatebackup*" OR CommandLine="*backup*"))
OR (Image="*\\bcdedit.exe" CommandLine="*recoveryenabled*" CommandLine="*no*")
OR (Image="*\\bcdedit.exe" CommandLine="*bootstatuspolicy*" CommandLine="*ignoreallfailures*")
OR (Image="*\\powershell.exe" CommandLine="*Win32_ShadowCopy*" CommandLine="*Delete*")
)
| eval Technique=case(
match(Image, "(?i)vssadmin"), "vssadmin_delete_shadows",
match(Image, "(?i)wmic"), "wmic_shadowcopy_delete",
match(Image, "(?i)wbadmin"), "wbadmin_delete_catalog_or_backup",
match(Image, "(?i)bcdedit") AND match(CommandLine, "(?i)recoveryenabled"), "bcdedit_disable_recovery",
match(Image, "(?i)bcdedit"), "bcdedit_ignore_boot_failures",
true(), "powershell_wmi_shadowcopy_delete"
)
| eval RiskScore=if(Technique IN ("vssadmin_delete_shadows","wmic_shadowcopy_delete","wbadmin_delete_catalog_or_backup"), 95, 80)
| bin _time span=30m
| stats count as Events, values(Technique) as Commands, max(RiskScore) as MaxRisk by host, User, _time
| sort - MaxRisk, - EventsSPL detection over Sysmon Event ID 1 (process creation) for the same four recovery-inhibition command patterns as the KQL rule: vssadmin bulk shadow-copy deletion, wmic shadowcopy delete, wbadmin catalog/system-state backup deletion, and bcdedit recovery/boot-failure-policy tampering, plus the PowerShell WMI shadow-copy deletion variant. Buckets matches into 30-minute windows per host/user so a batch script running several of these commands together is scored as a single high-risk cluster.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Scheduled backup software (Veeam, Acronis, Windows Server Backup) pruning shadow copies or rotating the local backup catalog per retention policy
- Administrators manually reclaiming shadow copy storage with vssadmin on volumes with previous-versions enabled
- Sysprep/golden-image pipelines adjusting bcdedit recovery/boot settings during image preparation
- VM/disk imaging tools clearing shadow copy state before capturing a template
Other platforms for THREAT-Impact-VSSShadowCopyDeletion
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Delete All Volume Shadow Copies via vssadmin
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=vssadmin.exe, CommandLine contains 'delete shadows /all /quiet'.
- Test 2Delete Shadow Copies via WMIC
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=wmic.exe, CommandLine contains 'shadowcopy delete'.
- Test 3Delete Local Backup Catalog via wbadmin
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=wbadmin.exe, CommandLine contains 'delete catalog -quiet'.
- Test 4Disable Windows Recovery Environment via bcdedit
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=bcdedit.exe, two events with CommandLine containing 'recoveryenabled no' and 'bootstatuspolicy ignoreallfailures' respectively.
References (7)
- https://attack.mitre.org/techniques/T1490/
- https://attack.mitre.org/tactics/TA0040/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-VSSShadowCopyDeletion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.