Shadow Copies Deletion Using Built-in Utilities
This rule detects attempts to delete shadow copies using built-in Windows utilities such as PowerShell, WMIC, or VSSAdmin. The detection specifically looks for command-line arguments containing 'shadow' and 'delete' when executed by these processes. This activity is commonly associated with ransomware or other destructive malware aiming to prevent system recovery.
CQL
