Makop Ransomware - VDS / WBEngine Abuse
Detects abnormal execution of Virtual Disk Service (vds.exe, vdsldr.exe) or Windows Backup Engine (wbengine.exe) processes. This activity is often abused by Makop ransomware to hinder system recovery by deleting backups or shadow copies. The rule specifically looks for these executables being initiated by processes other than svchost.exe, services.exe, or vds.exe, which are legitimate initiators.
Microsoft Sentinel (KQL)
