TrymeLocker cmd.exe Deletion or Tampering in System32/SysWOW64
Detects unauthorized deletion, renaming, or movement of system command-line utilities (cmd.exe) located in System32 or SysWOW64, correlated with the use of standard Windows tools to delete Volume Shadow Copies. This behavior is indicative of ransomware preparation to inhibit system recovery and interfere with standard administration tasks.
Microsoft Sentinel (KQL)
