Threat Hunting Exercise: Analyzing Windows Volume Shadow Copy Deletion Pre-Ransomware Dataset
This hunt uses a simulated endpoint dataset (windows_vss_delete_2022-08-15T023000.json) capturing T1490: Inhibit System Recovery, where an attacker deletes Volume Shadow Copies and disables backup/recovery options fleet-wide in the minutes preceding mass file encryption, to prevent victims from restoring data without paying a ransom.
Step 1: Hypothesis Formation
Hypothesis: Multiple hosts execute shadow-copy deletion and recovery-inhibiting commands (vssadmin, wbadmin, wmic shadowcopy delete, bcdedit) within a short window across the environment, immediately preceding a spike in file-modification/rename activity consistent with encryption. Indicators:
vssadmin.exe delete shadows /all /quietorwmic shadowcopy deleteexecuted on multiple hosts within minutes of each other.bcdedit /set {default} recoveryenabled noandbcdedit /set {default} bootstatuspolicy ignoreallfailuresdisabling Windows recovery boot options.wbadmin delete catalog -quietremoving local backup catalogs.- These commands are launched by the same parent process or script across all affected hosts (indicating centralized/automated execution, e.g., via PsExec or GPO abuse), not independent local admin actions.
Null Hypothesis: IT operations is performing legitimate disk-space cleanup or a documented backup-system migration that includes clearing old shadow copies. Invalidate by checking the change-management calendar and confirming the commands were not pushed via an unauthorized remote-execution channel.
Rationale: Shadow copy and backup-catalog deletion is one of the most reliable, high-fidelity pre-encryption indicators available, occurring in the overwhelming majority of human-operated ransomware intrusions; this hunt validates fleet-wide correlation of these specific commands as an early-warning trigger to act before encryption completes.
Step 2: Data Sources and Scope
- Sources: Sysmon Event ID 1 (Process Creation) for vssadmin/wmic/bcdedit/wbadmin; Windows Security Event 4688; EDR fleet-wide process telemetry; PsExec/WMI remote-execution logs.
- Scope: ~2022-08-15T02:30:00-02:38:00 UTC; 41 hosts across the
CORP-FILESERVERSandCORP-WORKSTATIONSOUs; Execution account: svc-backup-mgr (compromised). - SIEM Queries (Splunk/ELK):
index=sysmon EventCode=1 (CommandLine="vssadmindeleteshadows" OR CommandLine="wmicshadowcopydelete" OR CommandLine="bcdeditrecoveryenabledno") | stats dc(Computer) as affected_hosts by bucket(_time,10m) | where affected_hosts>5index=sysmon EventCode=1 CommandLine="wbadmindeletecatalog"- Remote-execution source:
index=wineventlog EventCode=4688 | search ParentImage="psexesvc.exe" AND CommandLine="vssadmin"
Step 3: Key Findings
Parsed events (6 shown) confirm shadow-copy and backup-catalog deletion commands executed near-simultaneously across 41 hosts via a compromised administrative account, immediately followed by mass file-rename activity indicative of ransomware encryption.
| Timestamp (UTC) | Host(s) | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-08-15 02:30:04 | FS-CORP-01 | Sysmon 1 | vssadmin.exe delete shadows /all /quiet via PsExec from svc-backup-mgr | Inhibit-Recovery IOC: shadow copy deletion is present in the vast majority of confirmed human-operated ransomware cases immediately pre-encryption. |
| 2022-08-15 02:30:05 - 02:34:50 | 40 additional hosts | Sysmon 1 | Identical vssadmin/wmic shadowcopy delete commands, same source account, same PsExec service | Scale IOC: 41 hosts hit within 5 minutes - impossible via manual per-host administration, confirms centralized automated execution. |
| 2022-08-15 02:35:10 | FS-CORP-01, FS-CORP-02 | Sysmon 1 | bcdedit /set {default} recoveryenabled no and bcdedit /set {default} bootstatuspolicy ignoreallfailures | Boot-Recovery IOC: disables the Windows Recovery Environment, preventing even a manual OS-level restore attempt post-encryption. |
| 2022-08-15 02:36:00 | FS-CORP-01 | Sysmon 1 | wbadmin.exe delete catalog -quiet | Backup-Catalog IOC: removes the local Windows Server Backup catalog, eliminating another restore path. |
| 2022-08-15 02:38:15 | FS-CORP-01 through 41 hosts | EDR file telemetry | Spike to 12,000+ file rename/write events per host per minute, extension changed to .lockbit3 | Encryption IOC: mass, high-speed file renaming with a ransomware extension began within 3 minutes of shadow-copy deletion completing across all hosts. |
| - | - | (account context) | svc-backup-mgr: legitimate backup service account, credentials found in a prior Kerberoasting incident 6 days earlier (see Hunting Exercise 58) | Confirms the account used was compromised, not misused by its legitimate owner. |
Validation:
- Timeline: shadow-copy deletion → boot-recovery disablement → backup-catalog deletion → mass encryption, all within 8 minutes across 41 hosts - this is the canonical human-operated ransomware pre-encryption sequence.
- False Positives: no change-management ticket authorizes shadow-copy or backup-catalog deletion on any of the 41 hosts; the account used was previously flagged as compromised.
- Correlation: identical commands, same source account and remote-execution channel, immediately followed by encryption across the full host set - conclusive evidence of an active ransomware event, not routine maintenance.
Step 4: Recommendations & Next Steps
- Immediate Response: This is an active incident - immediately disconnect affected hosts/segments from the network, disable svc-backup-mgr, and invoke the ransomware incident response plan; prioritize isolating unaffected hosts to halt further spread before full encryption completes; engage offline/immutable backups for restoration (do not rely on local shadow copies, which are now deleted).
- Detection: Sigma-style rule:
title: Mass Shadow Copy Deletion Across Multiple Hosts→selection: CommandLine IN ("vssadmindeleteshadows","wmicshadowcopydelete") | distinct_hosts_10m > 5. - Pro Tip: Alert on shadow-copy deletion commands as a Sev-1/critical event fleet-wide, regardless of source account legitimacy - the low false-positive rate of this specific indicator means every occurrence merits immediate investigation, not queued triage, since minutes matter once this stage begins.
Hypothesis confirmed - a compromised backup-service account was used to delete shadow copies and disable recovery options across 41 hosts in 8 minutes, immediately preceding a mass ransomware encryption event!