title: Shadow Copy Deletion Or Recovery Inhibition Via Built-In Tools
id: 6c4009db-0396-448a-a727-aa8af5d4b8fb
status: experimental
description: |
  Detects the destruction sequence that precedes most ransomware encryption: deleting volume
  shadow copies, deleting the backup catalogue, or disabling Windows recovery. The commands are
  usually seconds apart and run from one account on one host, which makes the first hit the
  timestamp worth building the timeline around.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.cisa.gov/stopransomware/ransomware-guide
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'catalog'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'Win32_ShadowCopy'
      - 'Delete'
  condition: 1 of selection_*
falsepositives:
  - Backup agents that prune shadow copies on a schedule. Exclude by the agent's signed parent image, never by command line alone.
  - Administrators reclaiming disk space by hand. Rare enough to be worth a conversation each time.
level: high