Ransomware TTP: Shadow Copy Deletion via VSSAdmin
This rule detects the use of the vssadmin.exe command-line tool to delete volume shadow copies. This is a common and high-confidence technique used by ransomware and other malicious actors to prevent system recovery and increase their leverage.
Microsoft Sentinel (KQL)
