splunk-security_content/detections/endpoint/delete_shadowcopy_with_powershell.yml

name: Delete ShadowCopy With PowerShell
id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
version: 1
date: '2021-05-12'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This following analytic detects PowerShell command to delete shadow copy
  using the WMIC PowerShell module. This technique was seen used by a recent adversary
  to deploy DarkSide Ransomware where it executed a child process of PowerShell to
  execute a hex encoded command to delete shadow copy. This hex encoded command was
  able to be decrypted by PowerShell log.
search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*")
  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `delete_shadowcopy_with_powershell_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the powershell logs  from your endpoints. make sure you enable needed
  registry to monitor this event.
known_false_positives: unknown
references:
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
- https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security
tags:
  analytic_story:
  - DarkSide Ransomware
  - Ransomware
  - Revil Ransomware
  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1490
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - Message
  - ComputerName
  - User
  security_domain: endpoint