Windows System Recovery Feature Tampering

Ankit Mehta@Secvyn

•updated Jun 25, 2026•0•0•1

Detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, cipher) to delete Volume Shadow Copies or modify boot/recovery configurations, which is a common behavior used by ransomware and attackers to inhibit system recovery.