index="REPLACE_WITH_ENDPOINT_INDEX" sourcetype="REPLACE_WITH_PROCESS_SOURCETYPE" dest="REPLACE_WITH_HOST" earliest=-24h latest=now
| eval exe=lower(process_name), cmd=lower(process)
| where (exe="vssadmin.exe" AND like(cmd,"%delete%") AND like(cmd,"%shadows%"))
    OR (exe="wmic.exe" AND like(cmd,"%shadowcopy%") AND like(cmd,"%delete%"))
    OR (exe="wbadmin.exe" AND like(cmd,"%delete%"))
    OR (exe="bcdedit.exe" AND like(cmd,"%recoveryenabled%"))
    OR (exe="wevtutil.exe" AND match(cmd,"(^|[^a-z])(cl|clear-log)([^a-z]|$)"))
| sort 500 - _time
| table _time dest user process_name process parent_process_name