Native Windows utility deletes shadow copies or disables recovery

Siemphony@siemphonylowT1490unverifiedPlaybook · Destructive impact

AN0933's CommandLinePattern knob names six native utilities together — vssadmin, wbadmin, diskshadow, bcdedit, REAgentC and wmic — and this rule now carries a selector for each of them, including the technique's own textbook example, `vssadmin.exe delete shadows /all /quiet`. The vssadmin, wbadmin, wmic shadowcopy and bcdedit selectors are the same observables the corpus's T1486 rule (data/detections/T1486/rule.yml) matches, because MITRE explains T1490 as augmenting T1485/T1486 rather than standing apart from them — a hit here is deliberately redundant with that rule rather than leaving this technique's own folder blind to its most common real-world execution path. `reagentc /disable` (turns off the Windows Recovery Environment's automatic repair) and `diskshadow.exe` invocation are the two commands unique to this rule; diskshadow's scripted shadow-copy deletion happens inside a script file this process-creation event never shows, so the tool's mere presence on the command line is what this rule can see, not what its script does. Every selection matches on CommandLine alone — the diskshadow leg was moved off Image so the rule stays a single-field OR that all four backends render. Renaming any of these six binaries before invoking it removes the matched substring from CommandLine and evades the corresponding selector entirely, identically to how T1486 is evaded. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0329, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Native Windows utility deletes shadow copies or disables recovery2id: b6eaab79-935e-4c17-8816-43b3e8ee82123status: experimental4description: |5  AN0933's CommandLinePattern knob names six native utilities together —6  vssadmin, wbadmin, diskshadow, bcdedit, REAgentC and wmic — and this rule now7  carries a selector for each of them, including the technique's own textbook8  example, `vssadmin.exe delete shadows /all /quiet`. The vssadmin, wbadmin,9  wmic shadowcopy and bcdedit selectors are the same observables the corpus's10  T1486 rule (data/detections/T1486/rule.yml) matches, because MITRE explains11  T1490 as augmenting T1485/T1486 rather than standing apart from them — a hit12  here is deliberately redundant with that rule rather than leaving this13  technique's own folder blind to its most common real-world execution path.14  `reagentc /disable` (turns off the Windows Recovery Environment's automatic15  repair) and `diskshadow.exe` invocation are the two commands unique to this16  rule; diskshadow's scripted shadow-copy deletion happens inside a script file17  this process-creation event never shows, so the tool's mere presence on the18  command line is what this rule can see, not what its script does. Every19  selection matches on CommandLine alone — the diskshadow leg was moved off20  Image so the rule stays a single-field OR that all four backends render.21  Renaming any of these six binaries before invoking it removes the matched22  substring from CommandLine and evades the corresponding selector entirely,23  identically to how T1486 is evaded.24  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0329, not hand-written and not tested by its author. Any lab result is on this rule's own page.25references:26  - https://attack.mitre.org/techniques/T149027  - https://attack.mitre.org/detectionstrategies/DET032928author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)29date: 2026-08-1630tags:31  - attack.impact32  - attack.t149033logsource:34  category: process_creation35  product: windows36detection:37  selection_vss_delete:38    CommandLine|contains|all:39      - 'vssadmin'40      - 'delete shadows'41  selection_wbadmin:42    CommandLine|contains|all:43      - 'wbadmin'44      - 'delete'45  selection_shadowcopy_wmi:46    CommandLine|contains|all:47      - 'shadowcopy'48      - 'delete'49  selection_bcdedit_recovery:50    CommandLine|contains|all:51      - 'bcdedit'52      - 'recoveryenabled'53  selection_reagentc:54    CommandLine|contains|all:55      - 'reagentc'56      - '/disable'57  selection_diskshadow:58    CommandLine|contains: 'diskshadow.exe'59  condition: 1 of selection*60falsepositives:61  - "VSS-aware backup software. diskshadow.exe is Microsoft's own tool for scripting application-consistent shadow copies, and commercial backup agents and SQL Server backup jobs invoke it and vssadmin routinely — on a backup server this can be the loudest match here by a wide margin, since the rule sees the tool's launch and not which script it was handed."62  - "Windows servicing. The setup process for a major Windows feature update runs `reagentc /disable` to free the recovery partition before it applies the update and re-enables WinRE afterward, so any host on a normal patch cadence produces this command line during its update window without anything malicious happening."63  - "OS deployment and imaging pipelines that disable WinRE with reagentc, clear shadow copies with vssadmin, or reset bcdedit recovery flags as documented steps before capturing or laying down a reference image."64  - "Administrators freeing disk space with vssadmin, retiring an old system state backup with wbadmin, or disabling the automatic repair loop with bcdedit while troubleshooting a boot problem, or running diskshadow.exe interactively to inspect or create a shadow copy."65  - "OEM factory-recovery-partition utilities (Dell SupportAssist OS Recovery, HP Recovery Manager, Lenovo OneKey Recovery) and AV/EDR post-incident remediation tooling that call `reagentc /disable` while rebuilding or reimaging the recovery partition."66level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "vssadmin" and ProcessCommandLine contains "delete shadows") or (ProcessCommandLine contains "wbadmin" and ProcessCommandLine contains "delete") or (ProcessCommandLine contains "shadowcopy" and ProcessCommandLine contains "delete") or (ProcessCommandLine contains "bcdedit" and ProcessCommandLine contains "recoveryenabled") or (ProcessCommandLine contains "reagentc" and ProcessCommandLine contains "/disable") or ProcessCommandLine contains "diskshadow.exe")

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*vssadmin*" AND CommandLine="*delete shadows*") OR (CommandLine="*wbadmin*" AND CommandLine="*delete*") OR (CommandLine="*shadowcopy*" AND CommandLine="*delete*") OR (CommandLine="*bcdedit*" AND CommandLine="*recoveryenabled*") OR (CommandLine="*reagentc*" AND CommandLine="*/disable*") OR CommandLine="*diskshadow.exe*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*vssadmin*" AND TO_LOWER(process.command_line) LIKE "*delete shadows*") OR (TO_LOWER(process.command_line) LIKE "*wbadmin*" AND TO_LOWER(process.command_line) LIKE "*delete*") OR (TO_LOWER(process.command_line) LIKE "*shadowcopy*" AND TO_LOWER(process.command_line) LIKE "*delete*") OR (TO_LOWER(process.command_line) LIKE "*bcdedit*" AND TO_LOWER(process.command_line) LIKE "*recoveryenabled*") OR (TO_LOWER(process.command_line) LIKE "*reagentc*" AND TO_LOWER(process.command_line) LIKE "*/disable*") OR TO_LOWER(process.command_line) LIKE "*diskshadow.exe*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)((?=.*(?:vssadmin))(?=.*(?:delete shadows)).*|(?=.*(?:wbadmin))(?=.*(?:delete)).*|(?=.*(?:shadowcopy))(?=.*(?:delete)).*|(?=.*(?:bcdedit))(?=.*(?:recoveryenabled)).*|(?=.*(?:reagentc))(?=.*(?:/disable)).*|diskshadow\.exe)</field>    <description>Native Windows utility deletes shadow copies or disables recovery</description>    <mitre>      <id>T1490</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: impact_destruction
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: b6eaab79-935e-4c17-8816-43b3e8ee8212

ATT&CKT1490

T1490Inhibit System Recovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1490, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Filter out events where the CommandLine field contains specific strings indicating legitimate system administration or maintenance activities.
Add a condition to exclude events where the process is run by a trusted system user or administrator account.
Consider adding a threshold for the number of shadow copy deletions or recovery disabling attempts within a certain time frame to reduce noise from isolated incidents.
Modify the selection criteria to include additional parameters or commands that are specific to malicious activities.

Declared by the author

VSS-aware backup software. diskshadow.exe is Microsoft's own tool for scripting application-consistent shadow copies, and commercial backup agents and SQL Server backup jobs invoke it and vssadmin routinely — on a backup server this can be the loudest match here by a wide margin, since the rule sees the tool's launch and not which script it was handed.
Windows servicing. The setup process for a major Windows feature update runs reagentc /disable to free the recovery partition before it applies the update and re-enables WinRE afterward, so any host on a normal patch cadence produces this command line during its update window without anything malicious happening.
OS deployment and imaging pipelines that disable WinRE with reagentc, clear shadow copies with vssadmin, or reset bcdedit recovery flags as documented steps before capturing or laying down a reference image.
Administrators freeing disk space with vssadmin, retiring an old system state backup with wbadmin, or disabling the automatic repair loop with bcdedit while troubleshooting a boot problem, or running diskshadow.exe interactively to inspect or create a shadow copy.
OEM factory-recovery-partition utilities (Dell SupportAssist OS Recovery, HP Recovery Manager, Lenovo OneKey Recovery) and AV/EDR post-incident remediation tooling that call reagentc /disable while rebuilding or reimaging the recovery partition.

Lessonimpact destruction

impact destructionAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects the use of native Windows utilities to delete shadow copies or disable recovery mechanisms, which could be indicative of an attacker's attempt to destroy or limit the availability of system backups and recovery points, making it harder to restore the system to a previous state in case of a security incident.

02 · Telemetry you need

Log source: process_creation
Product: windows
Specific fields: CommandLine
Audit setting: Process creation logging must be enabled, which may be off by default in some Windows configurations.

03 · How the logic works

The rule selects process creation events where the CommandLine field contains specific commands related to deleting shadow copies or disabling recovery mechanisms. It looks for commands involving vssadmin, wbadmin, shadowcopy, bcdedit, reagentc, and diskshadow.exe, with specific parameters such as delete shadows, delete, recoveryenabled, /disable, which are commonly used for these purposes. The condition is met if any of these selections are true, indicating a potential attempt to destroy system backups or recovery points.

04 · Common false positives

System administration tools that use vssadmin or wbadmin for legitimate backup and recovery management.
Disk management software that utilizes diskshadow.exe for creating or managing volume shadow copies.
Windows system maintenance tasks that may invoke bcdedit or reagentc for recovery configuration.
Third-party backup solutions that integrate with Windows utilities for shadow copy management.

05 · Detection maturity

tier_1: The rule as written may generate a high volume of false positives due to its broad selection criteria and lack of filtering for legitimate system activities.
tier_2: With tuning, such as filtering out known legitimate activities and adding thresholds, the rule can become more effective at detecting malicious attempts to destroy system backups and recovery points.
tier_3: Correlating this rule with other signals, such as suspicious process execution or network activity, can further enhance its maturity and provide a more comprehensive detection capability for impact destruction tactics.

Related detections2 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/b6eaab79-935e-4c17-8816-43b3e8ee8212

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Native Windows utility deletes shadow copies or disables recovery

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it