Deletion of Volume Shadow Copies via WMI with PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•19

Detects the deletion of Windows Volume Shadow Copies using PowerShell with WMI (Get-WmiObject/Get-CimInstance) or CIM (Remove-WmiObject/Remove-CimInstance) commands. This technique is commonly employed by ransomware families like Sodinokibi/REvil to prevent system recovery.