Delete delete_shadowcopy_with_powershell.yml

already merged in other PR

detections/endpoint/delete_shadowcopy_with_powershell.yml

@@ -1,39 +0,0 @@
-name: Delete ShadowCopy With PowerShell
-id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
-version: 1
-date: '2021-05-12'
-author: Teoderick Contreras, Splunk
-type: batch
-datamodel:
-- Endpoint
-description: this search is to detect powershell command to delete shadow copy using wmic powershell module.
-  This technique was seen in darkside ransomware where it will execute a child process powershell to execute an hex encoded
-  command to delete shadow copy. This hex encoded command was able to decrypt by powershell log.
-search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" 
-  stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `delete_shadowcopy_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
-tags:
-  analytic_story:
-  - Ransomware
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1490
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventCode
-  - Message
-  - ComputerName
-  - User
-  security_domain: endpoint