Shadow Copies Deletion Using Operating Systems Utilities

Action1: actionname = "Process started" AND ((PROCESSNAME endswith "\powershell.exe,\pwsh.exe,\wmic.exe,\vssadmin.exe,\diskshadow.exe" OR ORIGINALFILENAME = "PowerShell.EXE,pwsh.dll,wmic.exe,VSSADMIN.EXE,diskshadow.exe") AND (COMMANDLINE contains "shadow" AND COMMANDLINE contains "delete")) OR ((PROCESSNAME endswith "\wbadmin.exe" OR ORIGINALFILENAME = "WBADMIN.EXE") AND (COMMANDLINE contains "delete" AND COMMANDLINE contains "catalog" AND COMMANDLINE contains "quiet")) OR ((PROCESSNAME endswith "\vssadmin.exe" OR ORIGINALFILENAME = "VSSADMIN.EXE") AND ((COMMANDLINE contains "resize" AND COMMANDLINE contains "shadowstorage") AND COMMANDLINE contains "unbounded,/MaxSize=")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME