TrymeLocker Windows Recovery and Shadow Copy Destruction (T1490)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects multiple execution attempts of common Windows built-in utilities (bcdedit, vssadmin, wbadmin, wmic) used to disable recovery features or delete volume shadow copies within a 5-minute window. This behavior is highly characteristic of ransomware or destructive malware aiming to prevent system recovery.