Shadow Copy Deletion via vssadmin, wmic, or PowerShell (Pre-Ransomware T1490)

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

Detects the use of administrative tools (vssadmin, wmic, or PowerShell) to delete Volume Shadow Copies. This activity is a common pre-ransomware step used to inhibit system recovery and force data impact.