Naitik Shah
@NemesiZCompletionist
0 followers0 downloads0 copies0 likes6 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
1
1
1
1
This rule monitors for the execution of Windows utilities (vssadmin, wmic, diskshadow, wbadmin, bcdedit) with command-line arguments associated with deleting shadow copies or disabling system recovery features. This behavior is commonly observed in ransomware attacks to prevent system restoration.
