medium10 pts · first answer countsincident-responseransomwaredetection

Shadow copies being deleted

Your EDR alerts on this command on a file server at 02:10. What should you treat it as?

vssadmin.exe delete shadows /all /quiet

A.A likely ransomware step that removes local restore points before encryptingB.Normal Windows maintenance that runs every night after updatesC.A sign that the backup software is starting a full backupD.A harmless admin command that only frees a little disk space

Discussion 0

Join free to post in the discussion.

Shadow copies being deleted

Discussion 0

Related questions