Ransomware - Volume Shadow Copy Deletion

Georg Lauenstein@gsec

•updated 11 days ago•0•0•1

Detects usage of vssadmin or wmic to delete Volume Shadow Copies as observed in The Gentlemen ransomware operations to prevent system recovery before encryption deployment.