The True Cost of a Ransomware Attack: How BCDR Cuts Downtime, Recovery, and Legal Exposure

---
title: Volume Shadow Copy Deletion via vssadmin, wmic, or PowerShell
id: 3f8a2b41-7c5d-4e9a-b1f6-8d2c4a7e9b01
status: experimental
description: Detects deletion of volume shadow copies, a hallmark pre-encryption ransomware behavior designed to destroy local recovery options before payload detonation.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\diskshadow.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'delete shadows /all'
      - 'resize shadowstorage'
      - 'remove shadows'
  condition: selection_img and selection_cli
falsepositives:
  - Rare backup maintenance by administrators; tune against known admin accounts and management hosts
level: critical
---
title: Boot Recovery Options Disabled via bcdedit
id: 9c1d4e72-3a6b-4f8c-a2d5-7e9b1c3f5a08
status: experimental
description: Detects use of bcdedit to disable Windows recovery mode or ignore boot failures, a common ransomware pre-encryption step to prevent automated system recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
  - attack.t1562
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'recoveryenabled 0'
  condition: selection
falsepositives:
  - Legitimate imaging or kiosk configuration by system administrators (uncommon in most environments)
level: high
---
title: Windows Backup Catalog or Backup Infrastructure Tampering
id: 5b7e3a19-2f4d-4c8b-91a6-4d7f2e8c6b03
status: experimental
description: Detects deletion of the Windows backup catalog or suspicious processes accessing backup agent directories, indicating ransomware attempting to destroy recovery capability.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete backup'
      - 'delete systemstatebackup'
  selection_backup_procs:
    CommandLine|contains:
      - 'stop "Veeam'
      - 'stop "Datto'
      - 'taskkill'
      - 'net stop'
    CommandLine|contains|all:
      - 'backup'
  condition: selection_wbadmin or (selection_backup_procs)
falsepositives:
  - Scheduled backup rotation scripts; verify against change windows and service accounts
level: high

// Hunt: Pre-encryption ransomware staging — shadow copy deletion, recovery tampering, and backup service stops
// Tables: DeviceProcessEvents (Defender for Endpoint) and SecurityEvent (4688 via Sentinel)

let suspiciousCmds = dynamic([
    "delete shadows", "shadowcopy delete", "resize shadowstorage",
    "recoveryenabled no", "bootstatuspolicy ignoreallfailures",
    "delete catalog", "delete systemstatebackup"
]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "wbadmin.exe", "diskshadow.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (suspiciousCmds)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated asc;

// Correlate: same host attempting to stop backup/security services within the same window
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ ("net.exe", "net1.exe", "sc.exe", "taskkill.exe")
| where ProcessCommandLine has_any ("stop", "delete", "/f")
| where ProcessCommandLine has_any ("backup", "veeam", "datto", "shadow", "vss", "mssql", "sql")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated asc;

-- Hunt: Ransomware pre-encryption staging artifacts on Windows endpoints
-- Looks for shadow copy tampering processes, ransom notes, and recently executed encryptors

LET staging_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures|delete catalog|resize shadowstorage)'
   OR Name =~ '(?i)(vssadmin|bcdedit|wbadmin|diskshadow)\\.exe$'

LET ransom_notes = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/Desktop/*READ*ME*.txt',
                 'C:/Users/*/Documents/*RECOVER*.txt',
                 'C:/Users/*/*/*HOW*TO*DECRYPT*.txt',
                 'C:/*/*/README*.html'])
WHERE Mtime > now() - 86400

LET vss_state = SELECT * FROM execve(argv=['vssadmin', 'list', 'shadows'])

SELECT * FROM staging_procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'RANSOM_NOTE' AS Name, FullPath AS Exe,
       format(format='size=%v mtime=%v', args=[Size, Mtime]) AS CommandLine,
       '' AS Username, Btime AS CreateTime
FROM ransom_notes

# Security Arsenal — Ransomware Resilience & Backup Integrity Verification
# Run as Administrator. Review output before making changes in production.

# 1. Verify volume shadow copies exist and recent
Write-Host "[+] Checking Volume Shadow Copies..." -ForegroundColor Cyan
Get-CimInstance Win32_ShadowCopy | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize
$shadowCount = (Get-CimInstance Win32_ShadowCopy | Measure-Object).Count
if ($shadowCount -eq 0) { Write-Warning "NO shadow copies found — verify backup strategy and investigate for tampering." }

# 2. Verify boot recovery is enabled (ransomware commonly disables it)
Write-Host "[+] Checking boot recovery configuration..." -ForegroundColor Cyan
$bcd = bcdedit /enum {default} | Out-String
if ($bcd -match "recoveryenabled\s+No") {
    Write-Warning "Boot recovery DISABLED — common ransomware tampering indicator."
    bcdedit /set {default} recoveryenabled yes
    Write-Host "    Re-enabled boot recovery." -ForegroundColor Green
} else { Write-Host "    Boot recovery enabled." -ForegroundColor Green }

# 3. Verify VSS service and critical backup agents are running
Write-Host "[+] Checking backup/VSS service health..." -ForegroundColor Cyan
$services = @("VSS", "swprv", "VeeamBackupSvc", "DattoBackupAgentService", "WindowsBackup")
foreach ($svc in $services) {
    $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($s) { Write-Host ("    {0}: {1}" -f $svc, $s.Status) }
}

# 4. Audit recent shadow copy deletions (potential compromise indicator)
Write-Host "[+] Auditing recent vssadmin/wmic shadow deletions from process logs..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-3)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'delete shadows|shadowcopy delete|delete catalog|recoveryenabled no' } |
  Select-Object TimeCreated, Message -First 20 | Format-List

# 5. Harden: restrict shadow copy access & enable controlled folder access (Defender)
Write-Host "[+] Enabling Controlled Folder Access (anti-ransomware)..." -ForegroundColor Cyan
Set-MpPreference -EnableControlledFolderAccess Enabled
Set-MpPreference -EnableNetworkProtection Enabled

# 6. Verify backup targets are NOT mounted/persistently reachable from this host
Write-Host "[+] Checking for persistently mapped backup shares (lateral-encryption risk)..." -ForegroundColor Cyan
Get-SmbMapping | Select-Object LocalPath, RemotePath, Status | Format-Table -AutoSize
Write-Host "    >> Any backup repository mapped as a drive is reachable by ransomware. Use agent-based or credential-isolated backup instead." -ForegroundColor Yellow

Write-Host "[DONE] Review findings. Unexpected shadow deletion events or disabled recovery = escalate to IR." -ForegroundColor Cyan