Ransomware sabotages recovery before it encrypts. Detection engineering that alerts on shadow-copy deletion and GPO-pushed ...