The Gentlemen Ransomware - Shadow Copy and Backup Deletion
Detects the use of native Windows utilities (vssadmin, wmic, bcdedit, wbadmin) to delete volume shadow copies, disable system recovery, or remove backup catalogs, which are common actions taken by ransomware to inhibit system recovery.
Microsoft Sentinel (KQL)
