Process chains that use native utilities (vssadmin, wbadmin, diskshadow, bcdedit, REAgentC, wmic) with arguments to delete shadow copies, disable recovery, or remove backup catalogs
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| File Deletion (DC0040) | WinEventLog:Microsoft-Windows-Backup | Windows Backup Catalog deletion or catalog corruption |
| Service Metadata (DC0041) | WinEventLog:System | Service stopped or RecoveryDisabled set via REAgentC |
| Windows Registry Key Modification (DC0063) | WinEventLog:Sysmon | EventCode=13 |
| Field | Description |
|---|---|
| TimeWindow | Used to track rapid recovery feature changes over short intervals |
| CommandLinePattern | Can be tuned to catch variations in destructive flags (/all, /quiet, -delete) |
| ParentProcessContext | Tune based on common parent-child chains (e.g., powershell → diskshadow) |
Shell utilities or scripts deleting /etc/systemd/system/rescue.target, /etc/fstab backups, or /boot/efi partitions; chattr used to block snapshot auto-recovery
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | auditd:SYSCALL | chattr, rm, shred, dd run on recovery directories or partitions |
| File Deletion (DC0040) | auditd:CONFIG_CHANGE | /etc/fstab, /etc/systemd/* |
| Field | Description |
|---|---|
| WatchedFilePaths | Modify to include specific OS backup configs or LVM snapshots |
| ShellProcessUser | Restrict detection to root or sudo users |
ESXi shell or vim-cmd execution that deletes all VM snapshots using vmsvc/snapshot.removeall or rm on snapshot paths
| Data Component | Name | Channel |
|---|---|---|
| Snapshot Deletion (DC0049) | esxi:hostd | snapshot.removeall or snapshot file deletion |
| Field | Description |
|---|---|
| TargetVMNames | Limit to critical VM names to reduce false positives |
Execution of erase, format, and reload in immediate sequence from a privileged AAA session
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | networkdevice:syslog | command sequence: erase → format → reload |
| Field | Description |
|---|---|
| CommandSequenceWindow | Time between erase and reload command to establish causality |
| UserPrivilegeLevel | Filter for high-privilege user sessions |
Cloud API calls disabling snapshot scheduling, backup policies, versioning, followed by DeleteSnapshot/DeleteVolume operations
| Data Component | Name | Channel |
|---|---|---|
| Snapshot Deletion (DC0049) | AWS:CloudTrail | DeleteSnapshot |
| Cloud Storage Deletion (DC0022) | AWS:CloudTrail | PutBackupVaultAccessPolicy |
| Field | Description |
|---|---|
| UserAgent | Tune for legitimate backup automation vs unknown tools |
| ResourceType | Filter only on production images or vaults |