DragonForce-style Shadow Copy Deletion via WMIC/vssadmin
Detects attempts to delete Volume Shadow Copies using native Windows administrative tools such as wmic.exe and vssadmin.exe. This activity is frequently associated with ransomware, as adversaries often delete local backups to prevent data recovery.
Microsoft Sentinel (KQL)
