DragonForce shadow copy deletion via looped WMIC ID-based query

Arnold Chan@slaz

•updated Sep 9, 2026•0•0•0

Detects repeated attempts to delete Volume Shadow Copies using WMIC. This is a common technique used by ransomware and other malware to prevent system recovery and inhibit forensic investigations. The rule filters out known backup agents and service accounts and identifies patterns where multiple distinct deletions occur within a 5-minute window.