Chaos ransomware gta6.exe / Roaming svchost.exe shadow copy deletion and boot re
Detects execution of system recovery disabling utilities (vssadmin and bcdedit) spawned by a fake GTA6 application or a suspicious svchost.exe process running from the user Roaming directory, commonly associated with Chaos ransomware activity.
Splunk (SPL)
