Detection Gap: Legitimate Use of Windows Shadow‑Copy Deletion Tools Masks Ransomware Prep
What Happened – Attackers frequently invoke native Windows utilities ( vssadmin.exe, wmic shadowcopy delete, wbadmin.exe, bcdedit.exe ) to erase all volume shadow copies just before encrypting data. The same commands are also used by backup administrators for routine storage‑management tasks, creating a detection blind spot that lets the final ransomware step proceed unchecked.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of privileged command usage is a core control‑assurance activity; without it, the last viable recovery window can disappear before an alert is raised.
- Evidence of documented backup‑management schedules and immutable logging provides the defensible audit trail needed to prove due‑diligence under multiple frameworks.
- Mapping this technique to a control‑objective around “Backup Integrity and Recovery” demonstrates how a single control can satisfy requirements across SOC 2, ISO 27001, NIST CSF 2.0 and others.
Who Is Affected – Any organization that relies on Windows‑based backup and recovery processes – health‑care, financial services, SaaS providers, manufacturing, and government agencies.
Recommended Actions
- Implement real‑time alerting for any execution of shadow‑copy deletion utilities, correlating with user identity, schedule, and asset inventory.
- Enforce immutable logging of privileged commands and retain logs for a period that meets your regulatory obligations.
- Align the “Backup Integrity” control objective with your continuous‑evidence platform to demonstrate readiness for audits.
Source: Broadcom Symantec Blog – Detection Gap: MITRE ATT&CK T1490
Technical Notes
- Technique ID: MITRE ATT&CK T1490 – “Delete Shadow Copies”.
- Tools: vssadmin.exe, wmic shadowcopy delete, wbadmin.exe, bcdedit.exe (all signed Windows binaries).
- No new malware payload; the attack leverages native OS functionality to remove recovery points.
Source: same as above