sigma
sigma copied to clipboard
SigmaHQ
Deprecate redundant rule
There is a rule: e17121b4-ef2a-4418-8a59-12fb1631fa9e Delete Volume Shadow Copies via WMI with PowerShell - PS Script ()
However, there is another rule: c1337eb8-921a-4b59-855b-4ba188ddcc42 Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script.
This second rule effectively covers what the first rule is intended to detect. To avoid redundancy, I recommend removing the first rule.
