A deep dive into writing custom XML rules and decoders in Wazuh to detect shadow copy deletion, process injection, and vssadmin abuse in real time.

### Introduction

Ransomware operators frequently rely on living-off-the-land binaries (LOLBins) to prepare targeted host environments before executing payload encryption routines. One of the most common early-stage indicators of ransomware activity is the deletion of Volume Shadow Copies using binary utilities such as `vssadmin.exe` or PowerShell cmdlets.

In this technical guide, we will design and deploy custom detection rules within **Wazuh SIEM** to catch these malicious behaviors with high fidelity.

Step 1: Mapping the Threat to MITRE ATT&CK

- **Tactic**: Impact (TA0040) - **Technique**: Inhibit System Recovery (`T1490`) - **Sub-technique**: Deleting Volume Shadow Copies (`vssadmin delete shadows /all /quiet`)

When an attacker executes this command, Windows Event Log ID `4688` (Process Creation) captures the command line parameters if Command Line Process Auditing is enabled.

Step 2: Crafting the Custom Wazuh Rule

Add the following XML rule block into your `/var/ossec/etc/rules/local_rules.xml` configuration:

<group name="windows,process_creation,ransomware_t1490,">
  <rule id="100201" level="12">
    <if_sid>60103</if_sid>
    <field name="win.eventdata.newProcessName">vssadmin.exe</field>
    <field name="win.eventdata.commandLine">delete shadows</field>
    <description>Ransomware Indicator: Volume Shadow Copies deletion attempted via vssadmin.exe</description>
    <mitre>
      <id>T1490</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Step 3: Active Response Integration

To take automatic defensive action upon rule trigger, configure Wazuh Active Response to isolate the affected host endpoint immediately:

<active-response>
  <command>host-deny</command>
  <location>local</location>
  <rule_id>100201</rule_id>
  <timeout>3600</timeout>
</active-response>

Conclusion & Testing

By combining robust Windows process creation logging with custom Wazuh detection logic, SOC teams gain critical lead time before ransom notes drop. Always test rules against noisy benign environments to calibrate false positives prior to enabling automated host isolation!