Nightspire - Volume Shadow Copy Deletion (T1490)
Detects the hallmark Nightspire pre-encryption routine: executing vssadmin.exe or wmic.exe to quietly delete Volume Shadow Copies, preventing host restoration.
Microsoft Sentinel (KQL)
Detects the hallmark Nightspire pre-encryption routine: executing vssadmin.exe or wmic.exe to quietly delete Volume Shadow Copies, preventing host restoration.
Already have an account?