Delete ShadowCopy With PowerShell

This analytic detects the use of PowerShell to delete shadow copies, a common tactic used by ransomware to prevent data recovery. It specifically looks for PowerShell Script Block Logging (EventCode 4104) events containing keywords like "ShadowCopy" along with "Delete" or "Remove" in the ScriptBlockText. Successful execution of such commands can lead to irreversible data loss and hinder recovery efforts.