Ransomware Series: Volume Shadow Copy and Backup Catalog Deletion Prior to Encryption

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•3

Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to delete volume shadow copies, clear backup catalogs, or disable system recovery features, which is a common behavior of ransomware before encrypting files.