Akira Ransomware Deployment: locker.exe Shadow Copy Deletion and Encryption
Detects the execution of known Windows utilities (vssadmin, wmic, wbadmin) used to delete Volume Shadow Copies or the backup catalog, a common technique employed by ransomware to prevent system recovery. It also detects processes named locker.exe, commonly associated with ransomware binaries.
CQL
