Shadow Copy Deletion via WMI Win32_ShadowCopy Query and DeleteInstance

Duo Tech@duotech

•updated Jul 13, 2026•6•0•16

This rule detects attempts to interact with the Win32_ShadowCopy WMI class using command lines or event logs that indicate deletion or query activity (e.g., DeleteInstance, ExecQuery, SELECT). This is a common technique used by ransomware to inhibit system recovery by deleting volume shadow copies.