Volume-Shadow-Copy

Detection of anomalous process loading of the Volume Shadow Copy service DLL vsstrace.dll which may indicate unauthorized attempts to interact with or disrupt shadow copy operations.

Detection of the Volume Shadow Copy API library (vssapi.dll) being loaded by unauthorized processes, a common indicator of ransomware activity targeting backup shadow copies.

Detects the use of PowerShell to delete volume shadow copies, a tactic commonly employed by ransomware and other destructive attacks to hinder data recovery efforts.

The rule identifies the use of vssadmin.exe to delete or resize shadow copies on Windows endpoints, which is a common tactic used in ransomware attacks to prevent system recovery.

Attackers use Windows Management Instrumentation Command-line (WMIC) to delete volume shadow copies, inhibiting system recovery in ransomware and destructive attacks.