Ransomware activity often includes preparation before encryption begins. Attackers may attempt to reduce recovery options, remove backups, clear evidence, or change system settings that make restoration more difficult.

The source defines a Windows command-line hunt for several behaviors associated with this staging and impact phase.

Commands Included in the Hunt

The query looks for activity involving:

• vssadmin deleting shadow copies;

• WMI shadow-copy deletion;

• wbadmin deleting the backup catalog;

• bcdedit disabling recovery;

• wevtutil clearing logs;

• cipher /w;

• fsutil SymlinkEvaluation changes.

Detection Query

data.win.system.eventID:1 and data.win.eventdata.commandLine:(*vssadmin*delete*shadows* or *wmic*shadowcopy*delete* or *wbadmin*delete*catalog* or *bcdedit*recoveryenabled*no* or *wevtutil*cl* or *cipher*/w* or *fsutil*behavior*set*SymlinkEvaluation*)

The source recorded three matching events during the previous 30 days.

Why These Events Matter

Many of these commands have legitimate administrative uses, but several are uncommon in normal user activity.

Deleting shadow copies or backup catalogs, in particular, should be reviewed carefully when it happens outside approved maintenance or backup operations.

The event becomes more significant when combined with:

• suspicious shell execution;

• credential dumping;

• security-control disabling;

• mass file modification;

• newly created scheduled tasks;

• unusual remote administration.

Investigation Workflow

For each match, analysts should determine:

• who executed the command;

• whether the host is a workstation or server;

• the parent process;

• exact command line;

• whether backup or recovery operations were planned;

• other processes launched around the same time;

• whether multiple systems performed the same action.

If the command appears shortly before widespread file changes, the event should be treated as a potential ransomware precursor.

Tuning

Known backup software or maintenance scripts may legitimately invoke some of these commands.

Exceptions should therefore be based on known process paths, signed software, service accounts, and expected schedules.

Correlation Value

The small result count in the source makes this rule useful for manual review.

A particularly concerning chain could be:

credential dumping → remote execution → shadow copies deleted → logs cleared

Such correlation can help distinguish isolated administration from coordinated malicious activity.

Operational Value

Ransomware detection should not begin only when encryption is already visible. Monitoring recovery-inhibition behavior can provide earlier signals and help the SOC respond before the final impact stage is complete.