From e15810de9b614a81046d7cda79e26027c084e8a4 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 17 May 2021 09:49:40 +0200
Subject: [PATCH] Delete delete_shadowcopy_with_powershell.yml

already merged in other PR
---
 .../delete_shadowcopy_with_powershell.yml     | 39 -------------------
 1 file changed, 39 deletions(-)
 delete mode 100644 detections/endpoint/delete_shadowcopy_with_powershell.yml

diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml
deleted file mode 100644
index 25cb159580..0000000000
--- a/detections/endpoint/delete_shadowcopy_with_powershell.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: Delete ShadowCopy With PowerShell
-id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
-version: 1
-date: '2021-05-12'
-author: Teoderick Contreras, Splunk
-type: batch
-datamodel:
-- Endpoint
-description: this search is to detect powershell command to delete shadow copy using wmic powershell module.
-  This technique was seen in darkside ransomware where it will execute a child process powershell to execute an hex encoded
-  command to delete shadow copy. This hex encoded command was able to decrypt by powershell log.
-search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" 
-  stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `delete_shadowcopy_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
-tags:
-  analytic_story:
-  - Ransomware
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1490
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - EventCode
-  - Message
-  - ComputerName
-  - User
-  security_domain: endpoint
\ No newline at end of file