Deletion of Volume Shadow Copies via WMI with PowerShell
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND COMMANDLINE contains "Get-WmiObject,gwmi,Get-CimInstance,gcim" AND COMMANDLINE contains "Win32_ShadowCopy" AND COMMANDLINE contains ".Delete(),Remove-WmiObject,rwmi,Remove-CimInstance,rcim" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Tim Rauch, Elastic (idea)
