add rule delete volume shadow copies

2026-09-01 19:07:15 +00:00 · 2020-10-05 22:33:54 +02:00 · 2020-10-05 22:33:54 +02:00 · 649ecfa6ca
commit 649ecfa6ca
parent 648523d0bb
1 changed files with 15 additions and 0 deletions
--- a/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml
+++ b/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml
@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: delete volume shadow copies
+    namespace: impact/inhibit-system-recovery
+    author: moritz.raabe@fireeye.com
+    scope: function
+    att&ck:
+      - Impact::Inhibit System Recovery [T1490]
+    examples:
+      - B87E9DD18A5533A09D3E48A7A1EFBCF6:0x140006AF0
+  features:
+    - or:
+      - string: /vssadmin.* delete shadows/i
+      - string: /vssadmin.* resize shadowstorage/i
+      - string: /wmic.* shadowcopy delete/i