Ransomware Shadow Copy Deletion via vssadmin, wmic, or PowerShell

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•2

Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.