ransomware.json

{
    "wmic": {
        "process_name": ["wmic.exe"],
        "cmdline": ["wmic shadowcopy delete"]
    },
    "Vssadmin": {
        "process_name": ["vssadmin.exe"],
        "cmdline": ["vssadmin delete shadows /all /quiet"]
    },
    "bcdedit": {
        "process_name": ["bcdedit.exe"],
        "cmdline": ["bcdedit /set {default} bootstatuspolicy ignoreallfailures",
                    "bcdedit /set {default} recoveryenabled no"]
    },
    "wbadmin": {
        "process_name": ["wbadmin.exe"],
        "cmdline": ["wbadmin delete catalog -quiet"]
    }
}