Inhibit System Recovery via Microsoft Office Process

process where event.action == "start" and
  descendant of [process where event.action == "start" and
    process.name : (
      "WINWORD.EXE",
      "EXCEL.EXE",
      "POWERPNT.EXE",
      "MSACCESS.EXE",
      "MSPUB.EXE",
      "fltldr.exe"
    )] and
  not descendant of [process where event.action == "start" and
    process.name : (
      "iexplore.exe",
      "msedge.exe",
      "microsoftedge.exe",
      "chrome.exe",
      "firefox.exe",
      "opera.exe",
      "safari.exe"
    )] and
    (
    (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
    (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*")) or
    (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
    (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
    )