Inhibit System Recovery via Windows Command Shell

sequence with maxspan=1m
  [process where event.action == "start" and process.name : "cmd.exe" and
    not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
    not (process.args : "\\\\*\\SysVol\\*\\Policies\\{*}\\*" and process.parent.executable : "?:\\Windows\\System32\\gpscript.exe") and
    not process.command_line : ("*\\\\*\\*.cmd*", "*\\\\*\\*.bat*") and 
    not descendant of [process where event.action == "start" and process.executable : "?:\\Windows\\System32\\gpscript.exe"] and
    not (process.parent.executable : "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe" and
         user.id == "S-1-5-18" and process.args : "BOOTSTATUSPOLICY") and
    not (user.id == "S-1-5-18" and process.parent.executable : ("C:\\$VcmsTemp$\\VcmsPush.exe", "C:\\windows\\ctsrsvc.exe"))
  ] by process.entity_id
  [process where event.action == "start" and
    (
     (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
     (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*401*")) or
     (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
     (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
    ) and
    /* noisy FP patterns */
    not (process.name : "bcdedit.exe" and process.args : "DisplayAllFailures") and
    not (process.name : "wbadmin.exe" and process.args : "-keepVersions*") and
    not (process.name : "bcdedit.exe" and process.command_line: "*recoveryenabled*yes*") and
    /* granular deletion of a shadowcopy by unique ID often seen in legit deletion */
    not (process.name : "vssadmin.exe" and process.command_line : "*/shadow=*")
  ] by process.parent.entity_id