Shadow Copy Deletion via vssadmin, wmic, or wbadmin (T1490)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects the use of built-in Windows utilities (vssadmin, wmic, wbadmin) to delete shadow copies or backup catalogs. This activity is commonly associated with ransomware and data destruction attacks aiming to inhibit system recovery.