Detection of Volume Shadow Copy Deletion via PowerShell WMI

The deletion of Volume Shadow Copies is a prevalent technique employed by various ransomware actors, such as Sodinokibi/REvil, to hinder disaster recovery and incident response efforts. By leveraging PowerShell to interact with Windows Management Instrumentation (WMI) or Common Information Model (CIM) instances, attackers can identify and purge backup snapshots stored locally on the host. This activity typically occurs late in the attack lifecycle, immediately preceding the encryption of files. Because this behavior requires elevated privileges, the successful execution of these commands serves as a high-fidelity indicator of malicious intent rather than standard administrative maintenance. Detection engineers should focus on monitoring PowerShell Script Block logging to capture the invocation of WMI cmdlets directed at the Win32_ShadowCopy class.

Attack Chain

1. Initial access is established on the Windows endpoint via compromised credentials or vulnerability exploitation.
2. The attacker performs privilege escalation to gain local administrator or SYSTEM rights.
3. The attacker executes a PowerShell process or injects code into an existing PowerShell session.
4. The script uses Get-WmiObject or Get-CimInstance to enumerate instances of Win32_ShadowCopy.
5. The attacker invokes the .Delete() method on the identified shadow copy objects or utilizes Remove-WmiObject/Remove-CimInstance.
6. The system shadow copies are permanently removed, neutralizing native Windows backup recovery points.
7. The attacker proceeds to encrypt user files or exfiltrate sensitive data.

Impact

Successful deletion of Volume Shadow Copies prevents organizations from using native system restoration features to recover from ransomware encryption. This significantly increases the likelihood that victims must resort to either paying the ransom or performing complex offline backups restoration, causing substantial business downtime and operational loss.

Recommendation

Deploy the provided Sigma rule to monitor PowerShell Script Block logs (Event ID 4104) for commands targeting Win32_ShadowCopy via WMI/CIM. Enable PowerShell Script Block logging via Group Policy to ensure visibility into the script contents required for this detection. If noise is generated by management tools, audit and allowlist the specific service accounts or signing certificates associated with legitimate backup infrastructure.