Shadow copy deletion via WMIC/vssadmin/wbadmin (DragonForce locker)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•3•0•4

This rule detects the use of standard Windows administrative utilities (wmic.exe, vssadmin.exe, and wbadmin.exe) to perform destructive operations on volume shadow copies or backup catalogs. These actions are frequently associated with ransomware attacks to prevent system recovery.