How do you detect backup deletion before ransomware?

Alert on the commands and service changes that destroy restore options: wbadmin delete catalog or systemstatebackup, vssadmin and wmic shadow copy deletion, backup services stopping outside a change window, non-backup processes reading the backup configuration database, and mass file deletion on repository shares. These are rare in normal operations, so allowlist documented maintenance only. Raise severity when they follow credential access on the same host, and keep immutable or offline copies so a missed alert does not remove your recovery path.

Detecting Backup Deletion and Tampering Before Ransomware

Ransomware crews know that a clean backup ends their leverage, so they go after it first: stopping backup services, deleting catalogs and shadow copies, and reaching into backup servers for stored credentials. These actions are rare in normal operations and tightly clustered before deployment, which makes them high-value early warnings.

Signals at a Glance

Signal	Where	ATT&CK
wbadmin delete catalog or delete systemstatebackup	Sysmon 1, 4688	T1490
vssadmin or wmic shadow copy deletion	Sysmon 1, EDR	T1490
Backup agent or service stopped outside a change window	System 7036, EDR	T1489
Non-backup process reading the backup configuration database	EDR, SQL audit	T1555
Mass deletion of backup files on a repository share	File audit 4663	T1485

Backup Destruction Commands

The built-in commands are noisy by design and almost never run by administrators at scale. Treat any occurrence outside a documented maintenance task as an alert, and raise it to critical when it follows credential access on the same host:

title: Backup Catalog or Shadow Copy Deletion
logsource:
  category: process_creation
  product: windows
detection:
  sel_wbadmin:
    CommandLine|contains|all:
      - 'wbadmin'
      - 'delete'
    CommandLine|contains:
      - 'catalog'
      - 'systemstatebackup'
      - 'backup'
  sel_vss:
    CommandLine|contains|all:
      - 'shadows'
      - 'delete'
  sel_wmic:
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  condition: 1 of sel_*
level: high
# tune/validate: allowlist your backup vendor maintenance tasks by account and parent process

Backup Infrastructure Signals

Enterprise backup servers are targets in their own right. Watch the host, the service state and who touches the repository:

// Sentinel (KQL) - backup services stopped or disabled
Event
| where EventLog == "System" and EventID == 7036
| where RenderedDescription has_any ("Veeam", "Backup Exec", "Acronis", "Commvault", "Cohesity", "Rubrik")
| where RenderedDescription has "stopped"
| summarize stops=count(), services=make_set(RenderedDescription, 10) by Computer, bin(TimeGenerated, 30m)
| where stops >= 2
// tune/validate: service names vary by vendor and version

Keep backup servers off the general domain admin tier, and alert on interactive logons to them from non-backup administrators.
Enable immutability or air-gapped copies. Detection buys time; immutability removes the payoff.
Alert on repository share deletions measured in files per minute, not just on single events.
Page the incident team on backup tamper plus any credential-access signal within the same window.

Vetted sources

SigmaHQ shadow copy and backup-deletion rules, Elastic and Splunk ESCU analytics for vssadmin and wbadmin, and CISA #StopRansomware guidance on offline, tested backups. Service names and maintenance windows are specific to your estate, so baseline them before alerting.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Backup Destruction Commands

Backup Infrastructure Signals

Build Detections That Fire

Ransomware Precursor Detection

Detection Hub

Anti-Recovery Preparation Detection

Time-to-Ransom Compression