Liushen Shadow Copy and Recovery Deletion via vssadmin/wmic/diskshadow/bcdedit

Subhankar H@Andrewsec57

•updated Jul 8, 2026•0•0•11

Detects attempts to inhibit system recovery by deleting Volume Shadow Copies using native Windows utilities (vssadmin, wmic, diskshadow) or modifying boot configuration to disable recovery settings (bcdedit), as well as unauthorized modifications to the FilesNotToSnapshot registry key.