Disabled Volume Snapshots via VSS Diag
Detects commands that attempt to disable Volume Shadow Copy Service (VSS) diagnostic logging by setting the 'Disabled' flag. This activity is often associated with ransomware or other malware attempting to prevent recovery of encrypted files or to evade forensic analysis.
Sigma
