LCRYX Ransomware VSS Shadow Copy and Backup Deletion via wscript.exe

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects the execution of Windows recovery-inhibiting commands (shadow copy deletion, backup catalog deletion, and boot recovery policy modification) originating from wscript.exe, a behavior commonly associated with the LCRYX ransomware family.