splunk-security_content/detections/deleting_shadow_copies.yml

name: Deleting Shadow Copies
id: b89919ed-ee5f-492c-b139-95dbb162039e
version: 3
date: '2020-07-21'
description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy
  Service.  Wmic is an interface to the Windows Management Instrumentation.  This
  search looks for either of these tools being used to delete shadow copies.
how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including parent-child relationships from your endpoints to populate the Endpoint
  data model in the Processes node. The command-line arguments are mapped to the "process"
  field in the Endpoint data model.
type: ESCU
references: []
author: David Dorsey, Splunk
search: '| tstats `security_content_summariesonly` count values(Processes.process)
  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe
  OR Processes.process_name=wmic.exe)  by Processes.user Processes.process_name Processes.parent_process_name
  Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | search process=*delete* AND process=*shadow*
  | `deleting_shadow_copies_filter`'
known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped
  with modern versions of windows. They may be used by administrators to legitimately
  delete old backup copies, although this is typically rare.
tags:
  analytics_story:
  - Windows Log Manipulation
  - SamSam Ransomware
  - Ransomware
  mitre_attack_id:
  - T1485
  kill_chain_phases:
  - Actions on Objectives
  cis20:
  - CIS 8
  - CIS 10
  nist:
  - PR.PT
  - DE.CM
  - PR.IP
  security_domain: endpoint
  asset_type: Endpoint