How the locker kills recovery

Try it out loud first. Then check yourself:

1. vssadmin, wmic and PowerShell deletion spawn child processes (4688/Sysmon 1); WMI COM or VSS API calls run in-process, no child
2. No child process means in-process WMI (Win32_ShadowCopy) or VSS API deletion, a sign of a mature locker evading command-line rules
3. Confirm statically: imports/strings for Win32_ShadowCopy or IVssBackupComponents; also bcdedit recovery off and wbadmin catalog deletion
4. Recovery-inhibit method plus note, extension, kill lists and config cluster the family; compare to vendor reports and YARA rules
5. Deletion usually lands just before encryption; anchor the timeline there and look earlier for staging, exfil and tool drops

If the interviewer pushes back

• The sample resizes shadow storage instead of deleting copies. Why would it, and how would you detect that?

Go deeper

• attack.mitre.org/techniques/T1490/