Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-VSSShadowCopyDeletion.
Unlock with Pro - from £29/user/moDetect Shadow Copy and Backup Catalog Deletion via vssadmin/wbadmin/wmic in Sumo Logic CSE
Deleting Volume Shadow Copies and local Windows Server Backup catalogs is one of the most consistent pre-encryption steps observed across ransomware operators, because it removes the victim's fastest and cheapest recovery path before file encryption begins. Attackers who have already escalated privileges typically run one or more of: `vssadmin delete shadows /all /quiet` (bulk-deletes all shadow copies on all volumes, silently), `wmic shadowcopy delete` (the WMI equivalent, often used because vssadmin can be blocked by application allowlisting while wmic is overlooked), `wbadmin delete catalog -quiet` or `wbadmin delete systemstatebackup` (removes the local Windows Server Backup catalog and system-state backups so `wbadmin` itself can no longer be used to restore), and `bcdedit /set {default} recoveryenabled no` combined with `bcdedit /set {default} bootstatuspolicy ignoreallfailures` (disables the Windows Recovery Environment and automatic repair so a damaged/encrypted boot volume cannot self-heal). These four commands appear near-verbatim in incident reports for LockBit, Akira, Black Basta, BlackCat/ALPHV, Conti, and Ryuk, frequently chained together in a single batch script or PowerShell one-liner and executed seconds to minutes before the encryptor binary runs. The commands are legitimate, signed Windows administration utilities (LOLBins), so detection must key on the destructive argument combinations (bulk `delete shadows /all`, `shadowcopy delete`, `delete catalog`/`delete systemstatebackup`, `recoveryenabled no`) rather than on the binaries themselves, and correlate bursts of these commands across short windows and/or multiple hosts as the highest-confidence signal of an imminent or in-progress ransomware detonation.
MITRE ATT&CK
- Tactic
- Impact
Sumo Detection Query
_sourceCategory="windows/sysmon" EventID=1
(
(Image="*vssadmin.exe" and CommandLine matches "*delete*" and CommandLine matches "*shadow*")
or (Image="*wmic.exe" and CommandLine matches "*shadowcopy*" and CommandLine matches "*delete*")
or (Image="*wbadmin.exe" and CommandLine matches "*delete*")
or (Image="*bcdedit.exe" and CommandLine matches "*recoveryenabled*")
or (Image="*bcdedit.exe" and CommandLine matches "*bootstatuspolicy*")
)
| eval Technique = if(Image matches "*vssadmin*", "vssadmin_delete_shadows",
if(Image matches "*wmic*", "wmic_shadowcopy_delete",
if(Image matches "*wbadmin*", "wbadmin_delete_catalog_or_backup", "bcdedit_recovery_tamper")))
| timeslice 30m
| stats count as Events, values(Technique) as Techniques by Computer, User, _timeslice
| where Events >= 1
| sort by Events descSumo Logic Cloud SIEM search over Sysmon Event ID 1 for the recovery-inhibition command set. Groups matches into 30-minute timeslices per host/user, surfacing hosts where multiple distinct recovery-inhibition techniques (shadow-copy deletion, backup-catalog deletion, recovery-environment tampering) fire together as the highest-priority cluster.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled backup software pruning shadow copies or backup catalogs
- Administrators manually reclaiming shadow copy storage
- Golden-image pipelines adjusting bcdedit settings
- VM/disk imaging tools clearing shadow copy state
Other platforms for THREAT-Impact-VSSShadowCopyDeletion
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Delete All Volume Shadow Copies via vssadmin
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=vssadmin.exe, CommandLine contains 'delete shadows /all /quiet'.
- Test 2Delete Shadow Copies via WMIC
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=wmic.exe, CommandLine contains 'shadowcopy delete'.
- Test 3Delete Local Backup Catalog via wbadmin
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=wbadmin.exe, CommandLine contains 'delete catalog -quiet'.
- Test 4Disable Windows Recovery Environment via bcdedit
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=bcdedit.exe, two events with CommandLine containing 'recoveryenabled no' and 'bootstatuspolicy ignoreallfailures' respectively.
References (7)
- https://attack.mitre.org/techniques/T1490/
- https://attack.mitre.org/tactics/TA0040/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-VSSShadowCopyDeletion — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.