TOKYOCORE Ransomware Volume Shadow Copy Deletion via vssadmin
Detects the use of vssadmin.exe to delete all volume shadow copies with the '/all' and '/quiet' flags. This technique is commonly employed by ransomware, including TOKYOCORE, to prevent system recovery by destroying backup snapshots prior to file encryption.
Cortex XDR
