Backup deletion

Description

This query identifies use of wmic.exe to delete shadow copy snapshots prior to encryption.

Query · kql

DeviceProcessEvents
| where FileName =~ "wmic.exe"
| where ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete"
| project DeviceId, Timestamp, InitiatingProcessFileName, FileName,
ProcessCommandLine, InitiatingProcessIntegrityLevel, InitiatingProcessParentFileName
Raw source Backup deletion · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: fc2c12c1-ee93-45c2-9a1f-f8a143ec3eb1
name: Backup deletion
description: |
  This query identifies use of wmic.exe to delete shadow copy snapshots prior to encryption.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Ransomware
query: |
  DeviceProcessEvents
  | where FileName =~ "wmic.exe"
  | where ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete"
  | project DeviceId, Timestamp, InitiatingProcessFileName, FileName,
  ProcessCommandLine, InitiatingProcessIntegrityLevel, InitiatingProcessParentFileName

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.