Shadow Copy Deletion (Ransomware Indicator)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

Detects attempts to delete Volume Shadow Copies using 'vssadmin' or 'wmic' commands, which is a common tactic used by ransomware to prevent system recovery.