Can I hook “vssadmin.exe delete” process?

Question

I'm studying and listing ransomware family.(like CryptoWall, TorrentLocker, CTB-Locker, .etc)

When I read the features of those family, they do vssadmin.exe to delete shadow copies of victim's PC so that victim can't recover.

So is it possible? If I can hook vssadmin, the vssadmin process is paused until additional authentication (like face recognition in your laptop cam).

In other words, ransomware are not allowed to delete shadow copy. So if users are attacked by ransomware, user can recover some files.(even though, from certain date in shadow copy to current data are lost)

Thank you

Answer 1

Yes, but wouldn't you also need to hook wmic shadowcopy delete as well as other ways to do this?