# deadlock-ransomware-rust-encryptor-with-decentralized-recovery-i — Splunk SPL variant (derived from deadlock-ransomware-rust-encryptor-with-decentralized-recovery-i.sigma via sigma convert)
# source-sha256: d4d1b676ab6812734e3e7779773f4aa5ac015a95a326aa29db5e97d58d396cfd v1
(Image="*\\vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*\\wbadmin.exe" CommandLine="*delete*" CommandLine="*backup*") OR (Image="*\\wevtutil.exe" CommandLine IN ("*cl *", "*clear-log*", "*clear log*")) OR (Image="*\\sc.exe" CommandLine="*stop*" CommandLine="*WinDefend*")