Rule name: "Skopnix: Shadow copy or backup catalog deletion (T1490)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: ("Process Name" ILIKE 'vssadmin.exe' AND "Process CommandLine" ILIKE '%delete%' AND "Process CommandLine" ILIKE '%shadows%') OR ("Process Name" ILIKE 'wmic.exe' AND "Process CommandLine" ILIKE '%shadowcopy%' AND "Process CommandLine" ILIKE '%delete%') OR ("Process Name" ILIKE 'bcdedit.exe' AND "Process CommandLine" ILIKE '%recoveryenabled%' AND "Process CommandLine" ILIKE '%no%') OR ("Process Name" ILIKE 'wbadmin.exe' AND "Process CommandLine" ILIKE '%delete%' AND "Process CommandLine" ILIKE '%catalog%')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1490".
FP-safety: Each branch needs both the binary and the destructive verb (delete shadows / shadowcopy delete / recoveryenabled no / delete catalog); listing or creating shadow copies does not match.