Ransomware Shadow Copy Deletion via vssadmin or wmic
Detects the execution of vssadmin.exe or wmic.exe with command-line arguments intended to delete or resize Volume Shadow Copies. This is a common technique used by ransomware to prevent system recovery and inhibit administrative rollback of file changes.
SentinelOne
