Defense Evasion, Indicators Shadow Copy Deletion
Vssadmindelete
Query
DeviceProcessEvents
| where FileName has_any ("vssadmin.exe","wmic.exe") and (ProcessCommandLine contains "shadow" and ProcessCommandLine contains "delete")Explanation
This query looks for instances where shadow copies are deleted using Vssadmin or Wmic in a Windows environment. It is related to Defense Evasion and the indicators are tagged as T1490 and T1070.
