Creation of Shadow Copy via Vssadmin or Wmic

The analytic detects the creation of shadow copies using `vssadmin.exe` or `wmic.exe`. This activity is significant because creating shadow copies can be a precursor to ransomware attacks or data exfiltration, allowing attackers to bypass file locks and access sensitive data. If confirmed malicious, this behavior could enable attackers to maintain persistence, recover deleted files, or prepare for further malicious activities, posing a significant risk to the integrity and confidentiality of the system. Adversaries may create shadow copies to access the NTDS.dit file for credential dumping or to exfiltrate data.