GreenBlood Ransomware VSS and Backup Catalog Deletion
Detects attempts by GreenBlood ransomware or similar threats to delete Volume Shadow Copies and Windows Backup catalogs using 'wmic.exe', 'vssadmin.exe', and 'wbadmin.exe' with specific command-line arguments. This activity is typically performed to prevent system recovery and data restoration.
Microsoft Sentinel (KQL)
