Suspicious Volume Shadow Copy Deletion

Anoozilla HunterX@AnoozillaHunterX

•updated Jul 14, 2025•2•1•40

This detection identifies attempts to delete volume shadow copies using common utilities like vssadmin, wmic, or PowerShell. This is a technique frequently used by ransomware before encryption to prevent easy restoration of files.