skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-shadow-copy-deletion

Detect Volume Shadow Copy deletion activity indicating ransomware preparation or anti-forensics.

954|172|Updated Mar 13, 2026
Search Tags:#ransomware#detection#threat hunting#siem#t1490#vssadmin#shadow copy
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-shadow-copy-deletion
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-shadow-copy-deletion
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-shadow-copy-deletion
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-shadow-copy-deletion

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Ransomware operators and attackers routinely delete Volume Shadow Copies to prevent system recovery before encryption, and security teams need a structured way to hunt for this behavior across vssadmin, WMIC, PowerShell, and WMI-based deletion vectors that evade simple process-name detection.

Core Features & Use Cases

  • Multi-vector detection coverage: Hunts vssadmin delete shadows, wmic shadowcopy delete, PowerShell Win32_ShadowCopy removal, bcdedit recovery disabling, and direct VSS COM API calls that spawn no child process.
  • Evasion-aware guidance: Matches on command-line arguments and OriginalFileName rather than image names, and covers no-process deletions via WMI-Activity events 5857/5861.
  • Use Case: During a ransomware readiness assessment, run the hunt workflow against Sysmon and Windows Security Event logs in Splunk or Sentinel to find shadow copy deletion preceding encryption, then validate coverage with Atomic Red Team T1490 tests.

Quick Start

Hunt for shadow copy deletion activity across my Windows fleet using Sysmon and Security event logs and report any vssadmin, wmic, or PowerShell-based deletion attempts.

Frequently Asked Questions about hunting-for-shadow-copy-deletion

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect shadow copy deletion on Windows?▼

Monitor process creation events (Sysmon EID 1 or Security EID 4688) for command lines containing delete shadows, resize shadowstorage, or shadowcopy delete from vssadmin, wmic, and PowerShell. Match on CommandLine and OriginalFileName rather than image name to catch renamed binaries.

What MITRE ATT&CK technique covers shadow copy deletion?▼

Shadow copy deletion maps to T1490 Inhibit System Recovery, commonly executed before ransomware encryption under T1486. Related techniques include T1485 Data Destruction when deletion targets backups directly.

Can attackers delete shadow copies without spawning a process?▼

Yes, attackers can call Win32_ShadowCopy.Delete() through WMI or the VSS COM API from a loaded DLL, leaving no process creation event. Detect this with WMI-Activity events 5857 and 5861 instead of relying on EID 1 or 4688.

Why do shadow copy deletion alerts fire on legitimate activity?▼

Backup products like Veeam, Acronis, and Windows Backup legitimately resize or delete shadow copies during normal operations. Reduce false positives by baselining signed parent processes and expected backup schedules before alerting.

How do I validate shadow copy deletion detection coverage?▼

Run Atomic Red Team tests for T1490 using both the vssadmin and wmic variants, then confirm the command lines appear end to end in Sysmon EID 1 or Security EID 4688 in your SIEM.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Log Analysis & SIEM Integration

Parse security logs and generate SIEM detection queries for Splunk, Elastic, QRadar, Sentinel, and Sigma.

Official
Advanced
mgreen27mgreen27

ioc-tracker

Correlate indicators of compromise across multiple hosts from CSV data.

Community
Intermediate
jmaglyjmagly
175

log-analysis

Correlate authentication, system, application, and web server logs to detect attacker activity patterns.

Community
Advanced
bouwerpbouwerp

threat-hunting-sigma

Interpret and adapt Sigma rules for SIEM-based threat hunting.

Community
Advanced