Shadow Copy/Backup Deletion Precursor to Ransomware (T1490)

Ibrahim Saud@tektrix

•updated 16 days ago•0•0•0

Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to inhibit system recovery by deleting shadow copies, backup catalogs, or disabling automatic recovery features. This behavior is commonly observed in ransomware attacks.