Deletion of Volume Shadow Copies via WMI with PowerShell

심각도 높음 Sigma 탐지 룰. Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware famil…

작성자: Tim Rauch, Elastic (idea) · 원본 라이선스: DRL 1.1 · SigmaHQ 원본