Delete Volume Shadow Copies Via WMI With PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•29

This rule detects attempts to delete Volume Shadow Copies using PowerShell and WMI. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for PowerShell commands that interact with 'Win32_ShadowCopy' via 'Get-WmiObject' and then perform a 'Delete()' operation or use 'Remove-WmiObject'.