Volume Shadow Copy Unmounted
Nasreddine Bencherchali (Nextron Systems)
Detects unmounting of an NTFS volume shadow copy instance. While this can occur in normal cleaning activity, its a sign of VolumeShadowCopy deletion.
Nextron Sigma feed only (private)