Cortex XDR
#Scenario
Detect critical ransomware precursors by monitoring for the abrupt destruction of Volume Shadow Copies, a definitive indicator of likely Ransomware.
markdown
> Make sure you're comfortable with the results in your own environment before using this more widely.
# Snippet - Volume Shadow Copy deletion.
## Scenario
Immediately preceding a ransomware encryption stage, where shadow copies are wiped so users cannot restore files locally. The `vssadmin delete shadows /all /quiet` pattern is durable and remains one of the most reliable pre-encryption tells.
Logic: covers the three usual binaries used for backup destruction (`vssadmin`, `wmic shadowcopy`, `wbadmin delete catalog`). Any single hit on a workstation should be treated as a likely ransomware precursor.
- [https://attack.mitre.org/techniques/T1490/](https://attack.mitre.org/techniques/T1490/)
- [https://www.cisa.gov/stopransomware](https://www.cisa.gov/stopransomware)xql
// Make sure you're comfortable with the results in your own environment before using this more widely.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) in ("vssadmin.exe", "wmic.exe", "wbadmin.exe")
| filter (lowercase(action_process_image_command_line) contains "delete"
and lowercase(action_process_image_command_line) contains "shadow")
or lowercase(action_process_image_command_line) contains "delete catalog"
| fields _time, agent_hostname, actor_effective_username,
causality_actor_process_image_name, action_process_image_command_line
| limit 200