critical Sigma Windows

Volume Shadow Copy Deletion

The last quiet moment before ransomware encrypts. vssadmin, wmic or wbadmin destroying recovery points should page a human, not fill a queue.

Rule source

shadow-copy-deletion.yml

title: Volume Shadow Copy Deletion
id: 9d4b2e77-3c10-4f8a-a6b1-5e0d7c2f9a13
status: stable
description: >
  Destruction of shadow copies or the backup catalog - the last quiet moment
  before ransomware encrypts. This should page a human, not fill a queue.
references:
  - https://attack.mitre.org/techniques/T1490/
author: DetectionOps
date: 2026/09/08
logsource:
  product: windows
  category: process_creation
detection:
  vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'catalog'
  bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains: 'recoveryenabled no'
  condition: 1 of them
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Backup software pruning restore points on a schedule
  - Disk-space remediation scripts - allowlist the exact signed hash
level: critical
tags:
  - attack.impact
  - attack.t1490

Required telemetry

Sysmon Event ID 1 / Windows 4688 (process creation)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Backup software pruning restore points on a schedule
Disk-space remediation scripts - allowlist the exact signed hash

Validation

Atomic Red Team T1490-1 and -2 on a disposable VM snapshot

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.