Payouts King/Ransomware Shadow Copy Deletion and Recovery Inhibition

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects the use of native Windows administrative utilities (vssadmin, wmic, bcdedit, wbadmin, PowerShell) to disable or delete system recovery features, such as volume shadow copies, backup catalogs, or boot recovery options. These actions are common indicators of malicious activity, particularly ransomware, where an attacker attempts to prevent system recovery before data encryption or destruction.