hunting-for-shadow-copy-deletion

name	hunting-for-shadow-copy-deletion
description	Hunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","mitre-attack","shadow-copy","ransomware","anti-forensics","t1490","proactive-detection"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Platform Hardening","Restore Object","Restore Configuration","Restore Software","Software Update"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Hunting For Shadow Copy Deletion

When to Use

• When proactively hunting for indicators of hunting for shadow copy deletion in the environment
• After threat intelligence indicates active campaigns using these techniques
• During incident response to scope compromise related to these techniques
• When EDR or SIEM alerts trigger on related indicators
• During periodic security assessments and purple team exercises

Detection Gaps & Validation

• Cover every deletion vector: vssadmin delete shadows /all /quiet is the loud case, but also hunt wmic shadowcopy delete, PowerShell Get-WmiObject/Get-CimInstance Win32_ShadowCopy | Remove-*, bcdedit /set {default} recoveryenabled no, wbadmin delete catalog, and direct VSS COM API calls that spawn NO child process.
• Match on args, not image name: renaming vssadmin.exe → svc.exe defeats Image-based rules — key on EID 1/4688 CommandLine (delete shadows, resize shadowstorage) and OriginalFileName.
• No-process deletions: Win32_ShadowCopy.Delete() via a loaded DLL or WMI leaves no 4688/EID 1 — need WMI-Activity EID 5857/5861.
• Validate: run Atomic T1490 vssadmin and wmic variants; confirm EID 1/4688 command lines are captured end to end.
• FP tuning: legit backup suites (Veeam, Acronis, Windows Backup) resize/delete shadows — baseline by signed parent process and expected schedule.

Prerequisites

• EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
• SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
• Sysmon deployed with comprehensive configuration
• Windows Security Event Log forwarding enabled
• Threat intelligence feeds for IOC correlation

Workflow

1. Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
2. Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
3. Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
4. Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
5. Validate Findings: Distinguish true positives from false positives through contextual analysis.