Ransomware Shadow Copy Deletion via vssadmin, wmic, or PowerShell (T1490)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. This behavior is a common indicator of ransomware activity aimed at preventing system recovery.