Ransomware Backup Deletion via vssadmin/wbadmin/bcdedit/diskshadow (T1490)
Detects the use of native Windows utilities (vssadmin.exe, wbadmin.exe, bcdedit.exe, and diskshadow.exe) to delete volume shadow copies, clear backup catalogs, or modify boot configuration to inhibit system recovery, a common behavior observed in ransomware attacks.
SentinelOne
