Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

LockBit 3.0 – Defender Control Disable Followed by Shadow Copy Deletion

Lockbit3 Shadow Copy Deletion Sentinel
MITRE ATT&CK
Inhibit System Recovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (lockbit3)
What This Detects
Correlates execution of the 'Defender Control' AV-disabling utility with a subsequent vssadmin/wmic/bcdedit shadow-copy or recovery wipe on the same host – a signature LockBit 3.0 pre-encryption sequence.
Query
let disableDefender = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("dccon.exe","defendercontrol.exe","dc.exe") or ProcessCommandLine has "Defender Control"
| project DeviceName, DisableTime = Timestamp, DisableCmd = ProcessCommandLine;
let shadowWipe = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("vssadmin.exe","wmic.exe","bcdedit.exe")
| where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","bootstatuspolicy ignoreallfailures")
| project DeviceName, WipeTime = Timestamp, WipeCmd = ProcessCommandLine;
disableDefender
| join kind=inner shadowWipe on DeviceName
| where WipeTime - DisableTime between (0min .. 30min)
| project DeviceName, DisableTime, DisableCmd, WipeTime, WipeCmd

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.