(process.executable.caseless:*\\vssadmin.exe AND (process.command_line:*delete* AND process.command_line:*shadows*)) OR (process.executable.caseless:*\\wmic.exe AND (process.command_line:*shadowcopy* AND process.command_line:*delete*))
