Hunting For Shadow Copy Deletion
FreeProactively detect shadow copy deletion activities.
Free · Opens the source repo
What Hunting For Shadow Copy Deletion does
The Hunting For Shadow Copy Deletion skill provides a structured approach to threat hunting focused on the detection of Volume Shadow Copy deletions, a tactic often employed by ransomware and other malicious actors to inhibit system recovery. By leveraging telemetry from EDR and SIEM systems, this skill allows security professionals to query for specific commands related to shadow copy deletion, such as those executed via vssadmin, wmic, and PowerShell. This proactive detection mechanism is essential for identifying potential ransomware activities before they escalate into full-blown incidents.
This skill is particularly useful in environments where threat intelligence indicates active campaigns utilizing these techniques. It guides users through a hypothesis-driven workflow, enabling them to formulate testable hypotheses based on the latest threat intel. By identifying relevant data sources and executing targeted queries, security teams can analyze results for anomalies and validate findings through contextual analysis. The skill emphasizes the importance of correlating activities with broader attack chains and threat actor TTPs, ensuring a comprehensive understanding of the threat landscape.
The skill is designed for use during various scenarios, including incident response, security assessments, and purple team exercises. It requires a robust infrastructure, including an EDR platform with telemetry capabilities, a SIEM for log analysis, and threat intelligence feeds for effective IOC correlation. By documenting findings and updating detection rules, users can enhance their security posture against future threats.
Overall, this skill is a valuable addition to any security toolkit, enabling organizations to stay ahead of potential ransomware threats by proactively hunting for indicators of shadow copy deletion.
When to use it
Use this skill when actively hunting for indicators of shadow copy deletion, especially after receiving threat intelligence about ongoing campaigns.
When not to use it
This skill may not be suitable for environments lacking the necessary EDR and SIEM infrastructure or where threat intelligence is not available.
What you can build with it
Ransomware Detection
Use this skill to identify shadow copy deletions that may indicate ransomware is preparing to encrypt data.
Incident Response Preparation
Deploy this skill during incident response to scope potential compromises related to shadow copy deletion.
Security Assessments
Incorporate this skill into periodic security assessments to proactively hunt for indicators of shadow copy deletion.
How to install Hunting For Shadow Copy Deletion
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-shadow-copy-deletion --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting For Shadow Copy Deletion
When to Use
- When proactively hunting for indicators of hunting for shadow copy deletion in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1490 | Inhibit System Recovery |
| T1486 | Data Encrypted for Impact |
| T1485 | Data Destruction |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: Ransomware deleting shadow copies before encryption
- Scenario 2: vssadmin delete shadows /all /quiet pre-encryption
- Scenario 3: WMIC shadowcopy delete via PowerShell
- Scenario 4: bcdedit disabling recovery mode before impact
Output Format
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1490
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Hunting For Shadow Copy Deletion
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.