Shadow Copy Deletion - Ransomware Hardening

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•4

Detects attempts to delete volume shadow copies or disable system recovery features using common Windows utilities like vssadmin.exe, wmic.exe, bcdedit.exe, and cipher /w. This activity is often associated with ransomware to prevent system recovery.