add rule delete volume shadow copies

2026-06-08 15:41:20 +00:00 · 2020-10-05 22:33:54 +02:00
parent 648523d0bb
commit 649ecfa6ca
1 changed files with 15 additions and 0 deletions
@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: delete volume shadow copies
+    namespace: impact/inhibit-system-recovery
+    author: moritz.raabe@fireeye.com
+    scope: function
+    att&ck:
+      - Impact::Inhibit System Recovery [T1490]
+    examples:
+      - B87E9DD18A5533A09D3E48A7A1EFBCF6:0x140006AF0
+  features:
+    - or:
+      - string: /vssadmin.* delete shadows/i
+      - string: /vssadmin.* resize shadowstorage/i
+      - string: /wmic.* shadowcopy delete/i