Shadow Copy Deletion via Windows Management Instrumentation

[rule]
description = """
Identifies suspicious processes using Windows Management Instrumentation (WMI) to delete shadow copies. Adversaries may
delete shadow copies to prevent system recovery.
"""
id = "c8591841-6b50-42ea-a6c2-7f88b19897f0"
license = "Elastic License v2"
name = "Shadow Copy Deletion via Windows Management Instrumentation"
os_list = ["windows"]
version = "1.0.7"

query = '''
api where
  process.Ext.api.name like "IWbemServices::DeleteInstance*" and
  process.Ext.api.parameters.operation like "Win32_ShadowCopy.*" and
  not (process.executable : ("?:\\Program Files\\Veeam\\Backup and Replication\\*.exe", "?:\\Program Files (x86)\\Veeam\\Backup and Replication\\*.exe") and
       process.code_signature.subject_name in ("Veeam Software Group GmbH", "Veeam Software AG") and process.code_signature.trusted == true) and
  not (process.executable : "C:\\Windows\\System32\\svchost.exe" and process.parent.executable : "C:\\Windows\\System32\\services.exe") and
  not (process.executable : "C:\\Windows\\System32\\svchost.exe" and process.parent.executable : "C:\\Windows\\System32\\services.exe") and
  not process.executable : "C:\\Program Files\\2BrightSparks\\SyncBackPro\\SyncBackPro.exe" and
  not (process.parent.executable : "C:\\Windows\\System32\\cmd.exe" and
      process.command_line : "powershell  -ExecutionPolicy ByPass -FILE \"C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\*.ps1\" ")
'''

min_endpoint_version = "8.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "8.15.0"