From 649ecfa6ca8716e2040cfcebd3aebbe459b950ff Mon Sep 17 00:00:00 2001
From: Moritz Raabe <moritz.raabe@fireeye.com>
Date: Mon, 5 Oct 2020 22:33:54 +0200
Subject: [PATCH] add rule delete volume shadow copies

---
 .../delete-volume-shadow-copies.yml               | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 impact/inhibit-system-recovery/delete-volume-shadow-copies.yml

diff --git a/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml b/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml
new file mode 100644
index 00000000..8e26465f
--- /dev/null
+++ b/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml
@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: delete volume shadow copies
+    namespace: impact/inhibit-system-recovery
+    author: moritz.raabe@fireeye.com
+    scope: function
+    att&ck:
+      - Impact::Inhibit System Recovery [T1490]
+    examples:
+      - B87E9DD18A5533A09D3E48A7A1EFBCF6:0x140006AF0
+  features:
+    - or:
+      - string: /vssadmin.* delete shadows/i
+      - string: /vssadmin.* resize shadowstorage/i
+      - string: /wmic.* shadowcopy delete/i