Shadow copy or backup catalog deletion from the command line

Siemphony@siemphonyhighT1486unverified

Detects the recovery-destruction commands that precede or accompany ransomware encryption on Windows — shadow copy deletion and resizing, backup catalog removal, and the boot configuration edits that suppress automatic repair. This rule does not detect encryption. The encryption itself appears in telemetry only as a burst of writes and renames whose volume is the signal, and MITRE's FileExtension, TargetFolder and TimeWindow knobs all describe counting across that burst, which Sigma cannot express; the CommandLine knob of AN0602 is the one element of the analytic that lands in a single event, so that is what is written here. Every selection matches on CommandLine alone, so the rule is a single-field OR that all backends render. The same commands are the core observable for Inhibit System Recovery (T1490), and a hit should be triaged as either. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0215, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "vssadmin" and ProcessCommandLine contains "delete shadows") or (ProcessCommandLine contains "vssadmin" and ProcessCommandLine contains "resize shadowstorage") or (ProcessCommandLine contains "shadowcopy" and ProcessCommandLine contains "delete") or (ProcessCommandLine contains "wbadmin" and ProcessCommandLine contains "delete") or (ProcessCommandLine contains "bcdedit" and ProcessCommandLine contains "recoveryenabled") or (ProcessCommandLine contains "bcdedit" and ProcessCommandLine contains "ignoreallfailures"))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*vssadmin*" AND CommandLine="*delete shadows*") OR (CommandLine="*vssadmin*" AND CommandLine="*resize shadowstorage*") OR (CommandLine="*shadowcopy*" AND CommandLine="*delete*") OR (CommandLine="*wbadmin*" AND CommandLine="*delete*") OR (CommandLine="*bcdedit*" AND CommandLine="*recoveryenabled*") OR (CommandLine="*bcdedit*" AND CommandLine="*ignoreallfailures*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*vssadmin*" AND TO_LOWER(process.command_line) LIKE "*delete shadows*") OR (TO_LOWER(process.command_line) LIKE "*vssadmin*" AND TO_LOWER(process.command_line) LIKE "*resize shadowstorage*") OR (TO_LOWER(process.command_line) LIKE "*shadowcopy*" AND TO_LOWER(process.command_line) LIKE "*delete*") OR (TO_LOWER(process.command_line) LIKE "*wbadmin*" AND TO_LOWER(process.command_line) LIKE "*delete*") OR (TO_LOWER(process.command_line) LIKE "*bcdedit*" AND TO_LOWER(process.command_line) LIKE "*recoveryenabled*") OR (TO_LOWER(process.command_line) LIKE "*bcdedit*" AND TO_LOWER(process.command_line) LIKE "*ignoreallfailures*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)((?=.*(?:vssadmin))(?=.*(?:delete shadows)).*|(?=.*(?:vssadmin))(?=.*(?:resize shadowstorage)).*|(?=.*(?:shadowcopy))(?=.*(?:delete)).*|(?=.*(?:wbadmin))(?=.*(?:delete)).*|(?=.*(?:bcdedit))(?=.*(?:recoveryenabled)).*|(?=.*(?:bcdedit))(?=.*(?:ignoreallfailures)).*)</field>    <description>Shadow copy or backup catalog deletion from the command line</description>    <mitre>      <id>T1486</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: impact_destruction
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 31d883ab-4939-434d-b14c-de54513f2fd9

ATT&CKT1486

T1486Data Encrypted for Impact

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonimpact destruction

impact destructionAI draft — unreviewed

01 · What this rule detects

Command lines that destroy recovery options: shadow copy deletion and resizing, backup catalog removal, and the boot-configuration edits that suppress Windows automatic repair. Read the title again and notice what is missing. The technique is Data Encrypted for Impact, and this rule does not detect encryption. MITRE's AN0602 describes "high-frequency file write operations using uncommon extensions" — and three of its four tuning knobs (FileExtension, TargetFolder, TimeWindow) exist only to count and threshold that burst. Sigma matches one event at a time: no counter, no window, no way to say "five hundred renames in ten seconds". The encryption is unreachable in this language, and a rule claiming otherwise would be a lie that renders in four backends. What is reachable is the precursor. Ransomware crews delete shadow copies because a victim who can restore does not pay, and the deletion happens through a command line — a single event with the evidence in a single field. MITRE's fourth knob, CommandLine, is the one that lands in one record, so that is what the rule is built on. It fires before or during encryption, not after. These same commands are also the core observable for Inhibit System Recovery (T1490) — a hit is equally either technique. The tags: block carries only attack.t1486, so a coverage map drawn from tags will show T1490 uncovered while a rule for it sits right here.

02 · Telemetry you need

Process creation on Windows. On the Sysmon path that is EventID 1 with ProcessCreate enabled. On the Security 4688 path — which is what the Sentinel rendering resolves to — you need Audit Process Creation and the separate Include command line in process creation events policy. Neither is on by default. The review flags this as a contract gap: every arm of the rule depends on CommandLine, and a CommandLine field that is present but empty gives you zero rows. Zero rows reads as quiet; it means blind.

03 · How the logic works

Six selections, all on one field, joined by 1 of selection*:

The resize shadowstorage arm is the subtle one. Shrinking shadow storage to a few megabytes purges every snapshot without ever using the word "delete" — a tool name plus a subcommand, and the recovery data is gone. Now the flaw. contains|all means "both substrings appear somewhere in the line, any order, any distance". Four arms are anchored by a tool name plus a contiguous subcommand and are fine. Two are not: powershell -File C:\Scripts\Delete-StaleShadowCopy.ps1 satisfies the WMI arm with nothing deleted, because "shadowcopy" and "delete" both appear. The review's fix is to make those arms contiguous terms — 'shadowcopy delete', 'wbadmin delete'. Learn the shape: two loose substrings joined by `all` is a much weaker gate than it looks. Two things ship alongside. translations.json records a Wazuh refusal despite the single-field logic, and the Splunk rendering uses case-sensitive =, so it misses vssadmin.exe Delete Shadows /All /Quiet — Microsoft's own casing, and the textbook invocation. ES|QL lowercases correctly. Read the query your backend actually produced.

04 · Common false positives

Backup and imaging agents pruning their own restore points on a schedule.
Administrators freeing disk space or disabling the repair loop while
Build and imaging pipelines resetting a golden image.
The one the rule missed: scheduled Windows Server Backup retention, which

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0215 and never executed against a single log line.
tier_2: run it over historical process creation, confirm CommandLine is populated at all, and measure how much of the volume is your backup vendor.
tier_3: actual encryption detection — is not reachable in Sigma and belongs to EDR behavioural telemetry or a stateful correlation layer.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Scope by parent process and installation path of your backup agent rather than deleting the resize arm — resizing is the sneakiest variant and you want to keep it. Tighten the two loose arms to contiguous strings. Add attack.t1490 to the tags. Fix the Splunk casing before deployment.
And know the hole: Get-CimInstance Win32_ShadowCopy | Remove-CimInstance deletes every snapshot through COM. It contains "shadowcopy" but never "delete", and no arm asks for vssadmin alone. The rule watches the CLI doorway; the API doorway is open.

Declared by the author

Backup and imaging agents pruning their own restore points. Several commercial products call vssadmin to resize shadow storage or to delete a snapshot they created, and one of them running on a schedule will match here every cycle. Scope by the parent process and the installation path of the agent rather than by dropping the resize selection, since resizing storage to a few megabytes is a documented way to purge every snapshot at once.
Administrative recovery work. Freeing disk space with vssadmin, retiring an old system state backup with wbadmin, or disabling the automatic repair loop with bcdedit while troubleshooting a boot problem are all genuine tasks that produce exactly these command lines. Operator identity and a change record are what separate them, and neither is in this event.
Build, lab and imaging pipelines that reset a golden image, which routinely clear shadow copies and boot recovery settings as part of sysprep-adjacent cleanup.
Software installers and servicing routines that remove a restore point they took before a major upgrade.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1486, evaluated against their process_creation events.

Share this rule

/u/siemphony/31d883ab-4939-434d-b14c-de54513f2fd9

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Shadow copy or backup catalog deletion from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it