AN0933
Analytic 0933
Windows
Process chains that use native utilities (vssadmin, wbadmin, diskshadow, bcdedit, REAgentC, wmic) with arguments to delete shadow copies, disable recovery, or remove backup catalogs
WinEventLog:Sysmon
EventCode=1
WinEventLog:Microsoft-Windows-Backup
Windows Backup Catalog deletion or catalog corruption
WinEventLog:System
Service stopped or RecoveryDisabled set via REAgentC
WinEventLog:Sysmon
EventCode=13, 14
[TimeWindow]
Used to track rapid recovery feature changes over short intervals
[CommandLinePattern]
Can be tuned to catch variations in destructive flags (/all, /quiet, -delete)
[ParentProcessContext]
Tune based on common parent-child chains (e.g., powershell → diskshadow)
AN0934
Analytic 0934
Linux
Shell utilities or scripts deleting `/etc/systemd/system/rescue.target`, `/etc/fstab` backups, or `/boot/efi` partitions; chattr used to block snapshot auto-recovery
auditd:SYSCALL
chattr, rm, shred, dd run on recovery directories or partitions
auditd:CONFIG_CHANGE
/etc/fstab, /etc/systemd/*
[WatchedFilePaths]
Modify to include specific OS backup configs or LVM snapshots
[ShellProcessUser]
Restrict detection to root or sudo users
AN0935
Analytic 0935
ESXi
ESXi shell or vim-cmd execution that deletes all VM snapshots using vmsvc/snapshot.removeall or rm on snapshot paths
esxi:hostd
snapshot.removeall or snapshot file deletion
[TargetVMNames]
Limit to critical VM names to reduce false positives
AN0936
Analytic 0936
Network Devices
Execution of `erase`, `format`, and `reload` in immediate sequence from a privileged AAA session
networkdevice:syslog
command sequence: erase → format → reload
[CommandSequenceWindow]
Time between erase and reload command to establish causality
[UserPrivilegeLevel]
Filter for high-privilege user sessions
AN0937
Analytic 0937
IaaS
Cloud API calls disabling snapshot scheduling, backup policies, versioning, followed by DeleteSnapshot/DeleteVolume operations
AWS:CloudTrail
DeleteSnapshot
AWS:CloudTrail
DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances
[UserAgent]
Tune for legitimate backup automation vs unknown tools
[ResourceType]
Filter only on production images or vaults