mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
73 lines
3.8 KiB
YAML
73 lines
3.8 KiB
YAML
name: Delete ShadowCopy With PowerShell
|
|
id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
|
|
version: 13
|
|
creation_date: '2021-05-12'
|
|
modification_date: '2026-05-13'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic detects the use of PowerShell to delete shadow copies via the WMIC PowerShell module. It leverages EventCode 4104 and searches for specific keywords like "ShadowCopy," "Delete," or "Remove" within the ScriptBlockText. This activity is significant because deleting shadow copies is a common tactic used by ransomware, such as DarkSide, to prevent data recovery. If confirmed malicious, this action could lead to irreversible data loss and hinder recovery efforts, significantly impacting business continuity and data integrity.
|
|
data_source:
|
|
- Powershell Script Block Logging 4104
|
|
search: |-
|
|
`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*" OR ScriptBlockText = "*Remove*")
|
|
| fillnull
|
|
| stats count min(_time) as firstTime max(_time) as lastTime
|
|
BY dest signature signature_id
|
|
user_id vendor_product EventID
|
|
Guid Opcode Name
|
|
Path ProcessID ScriptBlockId
|
|
ScriptBlockText
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `delete_shadowcopy_with_powershell_filter`
|
|
how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event.
|
|
known_false_positives: No false positives have been identified at this time.
|
|
references:
|
|
- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
|
|
- https://www.techtarget.com/searchwindowsserver/tutorial/Set-up-PowerShell-script-block-logging-for-added-security
|
|
drilldown_searches:
|
|
- name: View the detection results for - "$user_id$" and "$dest$"
|
|
search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
- name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
|
|
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
|
|
earliest_offset: 7d
|
|
latest_offset: "0"
|
|
finding:
|
|
title: An attempt to delete ShadowCopy was performed using PowerShell on $dest$ by $user_id$.
|
|
entity:
|
|
field: user_id
|
|
type: user
|
|
score: 50
|
|
intermediate_findings:
|
|
entities:
|
|
- field: dest
|
|
type: system
|
|
score: 50
|
|
message: An attempt to delete ShadowCopy was performed using PowerShell on $dest$ by $user_id$.
|
|
analytic_story:
|
|
- DarkSide Ransomware
|
|
- Ransomware
|
|
- Revil Ransomware
|
|
- DarkGate Malware
|
|
- Cactus Ransomware
|
|
- VanHelsing Ransomware
|
|
asset_type: Endpoint
|
|
mitre_attack_id:
|
|
- T1490
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
category: endpoint
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/single_event_delete_shadowcopy.log
|
|
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
|
sourcetype: XmlWinEventLog
|
|
test_type: unit
|