// Microsoft Defender XDR Advanced Hunting. Read-only; not live-tested.
// Replace DeviceId with one affected device. Review change tickets for matches.
let TargetDevice = "REPLACE_WITH_DEVICE_ID";
DeviceProcessEvents
| where Timestamp between (ago(24h) .. now())
| where DeviceId == TargetDevice
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has_all ("shadowcopy", "delete"))
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete")
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled")
    or (FileName =~ "wevtutil.exe" and ProcessCommandLine has_any ("cl", "clear-log"))
| project Timestamp, DeviceId, DeviceName, AccountName, FileName,
    ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId
| order by Timestamp desc
| take 500