SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, LOGSOURCENAME(logsourceid) AS log_source, sourceip, username, "Process Name", "Process CommandLine"
FROM events
WHERE ("Process Name" ILIKE 'vssadmin.exe' AND "Process CommandLine" ILIKE '%delete%' AND "Process CommandLine" ILIKE '%shadows%') OR ("Process Name" ILIKE 'wmic.exe' AND "Process CommandLine" ILIKE '%shadowcopy%' AND "Process CommandLine" ILIKE '%delete%') OR ("Process Name" ILIKE 'bcdedit.exe' AND "Process CommandLine" ILIKE '%recoveryenabled%' AND "Process CommandLine" ILIKE '%no%') OR ("Process Name" ILIKE 'wbadmin.exe' AND "Process CommandLine" ILIKE '%delete%' AND "Process CommandLine" ILIKE '%catalog%')
LAST 7 DAYS