Potential Inhibit System Recovery via Command Line
This rule detects the execution of multiple commands commonly used by adversaries to inhibit system recovery, often seen in ransomware attacks. Specifically, it looks for the use of 'vssadmin delete shadows', 'wbadmin delete catalog', 'bcdedit /set', or 'diskpart' in conjunction with '/quiet' or '/force' parameters, and triggers if two or more such commands are executed within an hour on the same computer by the same user.
Microsoft Sentinel (KQL)
