Delete Volume Shadow Copies Via WMI With PowerShell (87df9ee1-5416-453a-8a08-e8d4a51e9ce1)
Shadow Copies deletion using operating systems utilities via PowerShell
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Delete Volume Shadow Copies Via WMI With PowerShell (87df9ee1-5416-453a-8a08-e8d4a51e9ce1) | Sigma-Rules | Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a) | Attack Pattern | 1 |