TrymeLocker Recovery Inhibition: vssadmin, bcdedit, wbadmin in 60s
Detects the suspicious execution of multiple system recovery inhibition commands (vssadmin.exe, bcdedit.exe, and wbadmin.exe) within a short timeframe (60 seconds) on the same host. This pattern of activity is consistent with the pre-encryption stage of many ransomware attacks, where adversaries attempt to prevent system restoration by deleting shadow copies and backup catalogs, and disabling boot recovery.
Microsoft Sentinel (KQL)
