Shadow Copy Deletion Associated with Ransomware Behavior

Ankit Mehta@Secvyn

•updated Jun 4, 2026•1•0•3

This rule detects attempts to delete shadow copies or system backups using built-in Windows utilities like vssadmin.exe, wbadmin.exe, and diskshadow.exe. These actions are often associated with ransomware behavior to prevent system recovery.