name: Deleting Shadow Copies
id: b89919ed-ee5f-492c-b139-95dbb162039e
version: 4
date: '2020-11-09'
author: David Dorsey, Splunk
type: batch
datamodel:
- Endpoint
description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy
  Service.  Wmic is an interface to the Windows Management Instrumentation.  This
  search looks for either of these tools being used to delete shadow copies.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe
  OR Processes.process_name=wmic.exe) Processes.process=*delete* Processes.process=*shadow*
  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `deleting_shadow_copies_filter`'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including parent-child relationships from your endpoints to populate the Endpoint
  data model in the Processes node. The command-line arguments are mapped to the "process"
  field in the Endpoint data model.
known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped
  with modern versions of windows. They may be used by administrators to legitimately
  delete old backup copies, although this is typically rare.
references: []
tags:
  analytic_story:
  - Windows Log Manipulation
  - SamSam Ransomware
  - Ransomware
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  - CIS 10
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1490
  nist:
  - PR.PT
  - DE.CM
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process
  - Processes.parent_process
  - Processes.process_name
  - Processes.user
  - Processes.parent_process_name
  - Processes.dest
  security_domain: endpoint
