Delete Volume Shadow Copies Via WMI With PowerShell — Detection Rule

Shadow Copies deletion using operating systems utilities via PowerShell

Read the full analysis on IntelFusions