Suspicious Shadow Copy Deletion and Recovery Modification

Naitik Shah@NemesiZ

•updated Jun 17, 2026•0•0•6

This rule monitors for the execution of Windows utilities (vssadmin, wmic, diskshadow, wbadmin, bcdedit) with command-line arguments associated with deleting shadow copies or disabling system recovery features. This behavior is commonly observed in ransomware attacks to prevent system restoration.