All Detections

Delete Volume Shadow Copies via WMI with PowerShell - PS Script

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Sigma