MedusaLocker Post-RoguePlanet: Backup Destruction Under SYSTEM Shell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the use of standard Windows administrative utilities (vssadmin.exe, wbadmin.exe, bcdedit.exe) to delete system backups, shadow copies, or disable recovery options. It specifically monitors for these commands when executed by suspicious parent processes or shells, which is a common tactic used by ransomware to prevent system restoration after encryption.