Detection: Akira shadow-copy deletion (T1490)
| File | Type | Data source | Notes |
|---|---|---|---|
sigma_akira_wmi_shadowcopy_delete.yml |
Sigma | process_creation (Sysmon 1 / 4688); PowerShell 4104 also shows the command | WmiPrvSE.exe → hidden powershell.exe with Win32_Shadowcopy + Remove-WmiObject |
This fires before any file is encrypted, so it is the earliest high-confidence signal. Possible false positives are rare administrative clean-ups through WMI. The rule has not been tested against a production log corpus.