VSS Shadow Copy Deletion
Detects the execution of vssadmin.exe to delete volume shadow copies, a common precursor to ransomware encryption utilized by Payload and other ransomware families. The rule specifically looks for `vssadmin.exe` being executed with the command-line arguments `delete shadows`, `/all`, and `/quiet`, indicating an attempt to silently remove all shadow copies.
Cortex XDR
