Deletion of Volume Shadow Copies via vssadmin or wmic

nomit vyas@xoxo

•updated Apr 30, 2026•2•0•99

This rule detects attempts to delete volume shadow copies using 'vssadmin.exe' or 'wmic.exe' with specific command-line arguments. This activity is often associated with ransomware or other destructive malware aiming to inhibit system recovery. The rule explicitly excludes commands containing 'backup' to reduce false positives.