Shadow copy deletion via WMI or vssadmin to inhibit recovery
Detects the use of built-in Windows utilities, specifically 'wmic.exe' and 'vssadmin.exe', to delete volume shadow copies. This is a common technique used by ransomware and other malware to prevent system recovery and impede incident response efforts.
Microsoft Sentinel (KQL)
