The Gentlemen RaaS - Shadow Copy and Backup Deletion Pre-Ransomware

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects the use of native Windows utilities to inhibit system recovery (e.g., deleting shadow copies or boot configuration changes) and to clear system event logs. These behaviors are common precursors or indicators of post-exploitation activity, such as ransomware deployment or intrusion cleanup.