BlackSuit ransomware staged over C$ share then vssadmin shadow copy deletion

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•3

Detects the correlation of an executable and command file staged via SMB to a Windows admin share (C$) followed closely by shadow copy deletion using vssadmin.exe on the same host, indicative of BlackSuit ransomware pre-encryption activity.