Shadow Copy Deletion via vssadmin.exe
Detects the invocation of vssadmin.exe with command-line arguments to delete all volume shadow copies silently, a common tactic used by ransomware to prevent system recovery.
Microsoft Sentinel (KQL)
Detects the invocation of vssadmin.exe with command-line arguments to delete all volume shadow copies silently, a common tactic used by ransomware to prevent system recovery.
Already have an account?