dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter (lowercase(action_process_image_name) = "vssadmin.exe" and lowercase(action_process_image_command_line) contains "delete" and lowercase(action_process_image_command_line) contains "shadows") or (lowercase(action_process_image_name) = "wmic.exe" and lowercase(action_process_image_command_line) contains "shadowcopy" and lowercase(action_process_image_command_line) contains "delete") or (lowercase(action_process_image_name) = "bcdedit.exe" and lowercase(action_process_image_command_line) contains "recoveryenabled" and lowercase(action_process_image_command_line) contains "no") or (lowercase(action_process_image_name) = "wbadmin.exe" and lowercase(action_process_image_command_line) contains "delete" and lowercase(action_process_image_command_line) contains "catalog")
| fields _time, agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line, actor_process_image_name, causality_actor_process_image_name
| sort desc _time