Payouts King Anti-Forensic Chain: VSS Delete, Event Log Clear, Recycle Bin Wipe
Detects the execution of anti-forensic techniques often associated with the Payouts King ransomware campaign. The rule monitors for the deletion of volume shadow copies via vssadmin, the clearing of Windows event logs using wevtutil, and the clearing of the recycle bin. The correlation of these events suggests an attempt to inhibit system recovery and remove indicators of compromise.
Sigma
