Inhibit System Recovery via Obfuscated Commands

process where event.action == "start" and
  descendant of
    [process where process.name : ("powershell.exe", "pwsht.exe", "cmd.exe") and
      process.command_line :
        (
          "*^*^*^*^*^*^*^*^*^*",
          "*set *set *set *",
          "*set *for *call *",
          "*set *for *cmd *",
          "*$*$*$*$*$*$*$*$*$*$*$*",
          "*comspec*",
          "*%%*%%*%%*",
          "*''*''*''*",
          "*`*`*`*`*",
          "*+*+*+*+*+*",
          "*[char[]](*)*-join",
          "*Base64String*",
          "*[*Convert]*",
          "*.Text.Encoding*",
          "*.Compression.*",
          "*.replace(*",
          "*MemoryStream*",
          "*WriteAllBytes*",
          "* -en* *",
          "* -ec *",
          "* -e *",
          "* /e *",
          "* /en* *",
          "* /ec *",
          "*WebClient*",
          "*DownloadFile*",
          "*DownloadString*",
          "*Invoke-Exp*",
          "*invoke-web*",
          "*iex*",
          "*iwr*",
          "*Reflection.Assembly*",
          "*Assembly.GetType*"
        )
  ] and
  (
    (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and 
	 process.command_line : "*delete*") or
    (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and 
	 process.command_line : ("*delete*", "*resize*")) or
    (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
    (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
  )