TrymeLocker Shadow Copy Deletion and Windows Recovery Disablement

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule detects the use of native Windows administration tools (vssadmin, wmic, wbadmin, and bcdedit) to inhibit system recovery. Actions include deleting volume shadow copies, deleting the backup catalog, disabling Windows automatic recovery, or tampering with boot status policies. Such activities are commonly associated with ransomware operations intended to prevent system restoration and increase the impact of data destruction.