Windows shadow copies deleted

This rule is part of a beta feature. To learn more, contact Support.
sentinelone

Classification:

attack

Tactic:

TA0040-impact

Technique:

T1490-inhibit-system-recovery

Set up the sentinelone integration.

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when vssadmin is used to delete shadow copies.

Strategy

Threat actors are known to use tools found natively in a victim’s environment to accomplish their objectives. Vssadmin.exe, a native Windows utility, can be used to delete all shadow copies on a system.

Triage and response

  1. Identify the user or service account deleting shadow copies, and confirm if this is authorized or expected.
  2. If it’s not authorized, isolate the host from the network.
  3. Follow your organization’s internal processes for investigating and remediating compromised systems.