OpnKey Ransomware Shadow Copy Deletion via vssadmin/wmic
Detects the execution of vssadmin.exe or WMIC.exe with commands intended to delete Volume Shadow Copies. This behavior is commonly associated with ransomware attempting to prevent system restoration by deleting local backups.
Sigma
