Skip to content
Threat Feed
Subscribe

Tag

Volume Shadow Copy

3 briefs RSS
high advisory

Volume Shadow Copy Deletion via PowerShell

Detects the use of PowerShell to delete volume shadow copies, a tactic commonly employed by ransomware and other destructive attacks to hinder data recovery efforts.

Windows impact powershell volume shadow copy ransomware
2r 1t
high advisory

VssAdmin Shadow Copy Deletion or Resize

The rule identifies the use of vssadmin.exe to delete or resize shadow copies on Windows endpoints, which is a common tactic used in ransomware attacks to prevent system recovery.

Windows volume-shadow-copy ransomware impact
2r 1t
high advisory

Volume Shadow Copy Deletion via WMIC

Attackers use Windows Management Instrumentation Command-line (WMIC) to delete volume shadow copies, inhibiting system recovery in ransomware and destructive attacks.

Windows volume-shadow-copy wmic ransomware impact
2r 2t