Akira Ransomware Pre-Encryption: Shadow Copy and Backup Recovery Destruction
Detects the deletion of volume shadow copies via vssadmin or wmic, removal of the Windows backup catalog using wbadmin, and the disabling of system recovery boot settings via bcdedit. This activity is consistent with pre-encryption preparation behavior observed in Akira ransomware attacks.
Sigma
