Skip to content
skopnix
Detections · Rule
← Sigma detectionsSigma · Behaviour (ATT&CK technique)

Shadow copy or backup catalog deletion (T1490)

SIGhighconfidence 85/100generated 2026-10-18

Deletion of Volume Shadow Copies or the Windows backup catalog, or disabling boot recovery — a step ransomware operators take right before encryption. Observed for: blackbyte, Medusa Group, Sandworm, Scattered Spider, Storm-0501, Void Manticore and 1 more.

ATT&CK
T1490 mitre ↗
Linked actors
blackbyte · Medusa Group · Sandworm · Scattered Spider · Storm-0501 · Void Manticore · WIZARD SPIDER
False positives
Each branch needs both the binary and the destructive verb (delete shadows / shadowcopy delete / recoveryenabled no / delete catalog); listing or creating shadow copies does not match.

Sigma rule

skopnix-sigma-ttp-t1490-41e9b893.ymldownload .yml ↓
title: Skopnix - Shadow copy or backup catalog deletion (T1490)
id: edeb521a-8407-572d-b58e-100b27d33051
status: experimental
description: 'Deletion of Volume Shadow Copies or the Windows backup catalog, or disabling boot recovery — a step ransomware operators take right before encryption. Observed for: blackbyte, Medusa Group, Sandworm, Scattered Spider, Storm-0501, Void Manticore and 1 more.'
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://skopnix.com/actors/blackbyte
  - https://skopnix.com/actors/medusa-group
  - https://skopnix.com/actors/sandworm
  - https://skopnix.com/actors/scattered-spider
  - https://skopnix.com/actors/storm-0501
  - https://skopnix.com/actors/void-manticore
  - https://skopnix.com/actors/wizard-spider
author: skopnix
date: '2026-10-18'
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
      - delete
      - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
      - shadowcopy
      - delete
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
      - recoveryenabled
      - 'no'
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains|all:
      - delete
      - catalog
  condition: 1 of selection_*
falsepositives:
  - Backup software or an administrator deliberately pruning shadow copies (rare; baseline by host and parent process)
level: high

How to deploy on Sigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

References