WMIC Shadowcopy DELETE

Author: MHaggis

datasets/attack_techniques/T1490/shadowcopy_del/shadowcopy_del.yml

@@ -1,14 +1,16 @@
 author: Bhavin Patel
 id: cc9b261f-efc9-11eb-926b-550bf0943fbb
-date: '2020-11-09'
+date: '2025-03-18'
 description: This technique was seen in darkside ransomware where it will execute
   a child process powershell to execute an hex encoded command to delete shadow copy.
-  This hex encoded command was able to decrypt by powershell log.
+  This hex encoded command was able to decrypt by powershell log. WMIC shadowcopy delete behavior. 
 environment: attack_range
 dataset:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/shadowcopy_del/windows-powershell.log
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/shadowcopy_del/wmicshadowcopydelete_sysmon.log
 sourcetypes:
 - WinEventLog:Microsoft-Windows-PowerShell/Operational
 - wineventlog
+- XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
 references:
 - https://attack.mitre.org/techniques/T1490/

datasets/attack_techniques/T1490/shadowcopy_del/wmicshadowcopydelete_sysmon.log

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:94d79d186a94c50f924c4ef22c36ce091b8fcefb3375779b7d64d231c520498f
+size 3905