TrymeLocker Inhibit System Recovery via VSS, BCD, and SystemRestore Registry

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

This rule detects the use of standard Windows administrative utilities (vssadmin, wmic, bcdedit) to delete volume shadow copies or modify boot configuration settings to disable recovery features. This behavior is a common indicator of ransomware or destructive malware activity attempting to prevent system restoration after data encryption or destruction.