CmdID / Rules / Windows

Shadow Copies Deletion Using Operating Systems Utilities

A Sigma rule for process creation on Windows, by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades).

high 2 ATT&CK techniques 6 programs it names 7 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection1_cli:
    CommandLine|contains|all:
      - 'shadow'
      - 'delete'
  selection1_img:
    - Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\wmic.exe'
        - '\vssadmin.exe'
        - '\diskshadow.exe'
    - OriginalFileName:
        - 'PowerShell.EXE'
        - 'pwsh.dll'
        - 'wmic.exe'
        - 'VSSADMIN.EXE'
        - 'diskshadow.exe'
  selection2_cli:
    CommandLine|contains|all:
      - 'delete'
      - 'catalog'
      - 'quiet'
  selection2_img:
    - Image|endswith: '\wbadmin.exe'
    - OriginalFileName: 'WBADMIN.EXE'
  selection3_cli:
    CommandLine|contains:
      - 'unbounded'
      - '/MaxSize='
    CommandLine|contains|all:
      - 'resize'
      - 'shadowstorage'
  selection3_img:
    - Image|endswith: '\vssadmin.exe'
    - OriginalFileName: 'VSSADMIN.EXE'
  condition: (all of selection1*) or (all of selection2*) or (all of selection3*)

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

To delete the oldest shadow copy of volume C, type on the page for vssadmin delete shadows

vssadmin delete shadows /for=c: /oldestIdentify

To delete all client-accessible shadow copies of volume D, type on the page for vssadmin delete shadows

vssadmin delete shadows /for=d: /allIdentify

To delete a single client-accessible shadow copy by its ID, first run vssadmin list shadows to find the shadow copy ID. Then run the following command, replacing c: with the volume that hosts the shadow copy and <ShadowID> with the ID you want to delete. Enter the ID in the format XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, where each X is a hexadecimal character on the page for vssadmin delete shadows

vssadmin delete shadows /for=c: /shadow=<ShadowID>Identify

To delete all client-accessible shadow copies of volume D without showing progress messages, add the /quiet parameter on the page for vssadmin delete shadows

vssadmin delete shadows /for=d: /all /quietIdentify

To resize shadow copy of volume C on volume D, with a maximum size of 900MB, type on the page for vssadmin resize shadowstorage

vssadmin resize shadowstorage /For=C: /On=D: /MaxSize=900MBIdentify

To resize shadow copy of volume C on volume D, with no maximum size, type on the page for vssadmin resize shadowstorage

vssadmin resize shadowstorage /For=C: /On=D: /MaxSize=UNBOUNDEDIdentify

To resize shadow copy of volume C by 20%, type on the page for vssadmin resize shadowstorage

vssadmin resize shadowstorage /For=C: /On=C: /MaxSize=20%Identify

The commands LOLBAS or GTFOBins documents for vssadmin.exe trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here

diskshadow.exevssadmin.exewbadmin.exewmic.exepowershellpowershell.exe

ATT&CK

the techniques it is tagged with

T1070Indicator Removal

T1490Inhibit System Recovery

Shadow Copies Deletion Using Operating Systems Utilities

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1070 Indicator Removal