Volume Shadow Copy and Backup Catalog Deletion
Detects the use of administrative utilities such as vssadmin.exe, wmic.exe, and wbadmin.exe to delete volume shadow copies or backup catalogs. This behavior is a common indicator of ransomware attempting to inhibit system recovery prior to encryption.
Microsoft Sentinel (KQL)
