Inhibit System Recovery via Untrusted Parent Process

sequence with maxspan=1m
  [process where event.action == "start" and
    process.Ext.token.integrity_level_name : ("high", "system") and
    not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe", "?:\\Windows\\System32\\*.exe", "?:\\Windows\\SysWOW64\\*.exe") and
    not process.code_signature.trusted == true and
    not process.hash.sha256 : "60ccd4ba2566d96676b448203fb4414a39c7c1e004e8c3fa1bbce139403ef1fb"] by process.entity_id
  [process where event.action == "start" and
    (
      (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
      (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*")) or
      (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
      (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
    ) and
    not (process.name : "bcdedit.exe" and process.args in ("ignoreallfailures", "displayallfailures"))
  ] by process.parent.entity_id