Detecting Shadow Copy Deletion Before Encryption

Deleting Volume Shadow Copies removes the easiest local recovery path, so most Windows ransomware does it, and affiliates often do it by hand just before detonation. The commands are well known and short, yet they come in many forms: vssadmin, wmic, diskshadow, PowerShell and WMI calls, and shadow storage resizing. A good rule covers all of them and looks at the parent process, not just the string.

Signals at a Glance

Command-Line Coverage

String matching on the command line catches the commodity cases and costs almost nothing. The rule below covers the common forms; the second condition catches the shadow storage trick, where the cap is shrunk so Windows purges existing copies without an explicit delete:

title: Volume Shadow Copy Deletion Or Resize
logsource:
  product: windows
  category: process_creation
detection:
  vssadmin_delete:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  wmic_delete:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  diskshadow:
    Image|endswith: '\diskshadow.exe'
    CommandLine|contains:
      - '/s '
      - '-s '
  powershell_wmi:
    CommandLine|contains|all:
      - 'Win32_Shadowcopy'
      - 'Remove-WmiObject'
  resize_storage:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'resize'
      - 'shadowstorage'
  condition: 1 of them
level: high
# tune/validate: backup software and imaging tools legitimately manage shadow copies.

Command-line rules miss tooling that calls the VSS COM or WMI APIs directly. Close that gap by watching for the same effect from a process that is not on your list of known backup agents, for example through your EDR’s API-call or WMI telemetry.

Context That Raises Confidence

• Parent process matters. A shadow delete spawned by a script host, PsExec, a service created minutes earlier or a remote WMI session is far more suspicious than one from a known backup agent.
• Sequence beats single events. Shadow deletion followed within minutes by boot configuration changes and service stops is a pre-encryption chain you can score as one detection.
• Account matters. Look for the command running under a domain admin or service account that rarely logs on interactively.
• Legitimate use is narrow: backup agents, system administrators and imaging tools. Allowlist them by signed image path and account, not by command line alone.