Ransomware - Recovery Inhibition via Shadow Copy and BCDEdit

Georg Lauenstein@gsec

•updated 10 days ago•1•1•13

Detects shadow copy destruction and recovery feature tampering used by Akira and other ransomware families to prevent victims from restoring data. Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and bcdedit recovery-disabling commands executed from the command line.