Ransomware VSS Deletion via vssadmin/wmic/PowerShell/wbadmin

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•2

Detects the use of native Windows utilities (vssadmin, wmic, powershell, wbadmin) to delete volume shadow copies or backup catalogs. This activity is commonly associated with ransomware or destructive attacks attempting to prevent system recovery.