Qilin — Mass File Encryption via vssadmin Shadow Copy Deletion
Detects attempts to delete Volume Shadow Copies (VSS) using 'vssadmin' or 'wmic' commands, especially when these commands are executed by unusual parent processes. This activity is a common tactic used by ransomware, such as Qilin, to prevent system recovery.
Microsoft Sentinel (KQL)
