Individual skill

hunting-for-shadow-copy-deletion

Hunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.

internal/tools/skills/data/threat-hunting/hunting-for-shadow-copy-deletion/SKILL.md

Read pinned source

Source commit d42f381ad34843e71a42658e5c57290c713e85af

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 7, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 1,313
Repository last updated: Nov 7, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

cybersecurity Repository topic
security Repository topic
bug-bounty Repository topic
automation Repository topic
autonomous-pentesting Repository topic
ai-agent Repository topic
ai-security Repository topic
ethical-hacking Repository topic
golang Repository topic
penetration-testing Repository topic
threat-hunting Declared skill tag
mitre-attack Declared skill tag
shadow-copy Declared skill tag
ransomware Declared skill tag
anti-forensics Declared skill tag
t1490 Declared skill tag
proactive-detection Declared skill tag
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 4,310 bytes

Read excerpt


# Hunting For Shadow Copy Deletion

## When to Use

- When proactively hunting for indicators of hunting for shadow copy deletion in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises

## Detection Gaps & Validation

- **Cover every deletion vector:** `vssadmin delete shadows /all /quiet` is the loud case, but also hunt `wmic shadowcopy delete`, PowerShell `Get-WmiObject/Get-CimInstance Win32_ShadowCopy | Remove-*`, `bcdedit /set {default} recoveryenabled no`, `wbadmin delete catalog`, and direct VSS COM API calls that spawn NO child process.
- **Match on args, not image name:** renaming vssadmin.exe → svc.exe defeats Image-based rules — key on EID 1/4688 CommandLine (`delete shadows`, `resize shadowstorage`) and `OriginalFileName`.