Shadow Copy Deletion via Windows Management Instrumentation

api where
  process.Ext.api.name like "IWbemServices::DeleteInstance*" and
  process.Ext.api.parameters.operation like "Win32_ShadowCopy.*" and
  not (process.executable : ("?:\\Program Files\\Veeam\\Backup and Replication\\*.exe", "?:\\Program Files (x86)\\Veeam\\Backup and Replication\\*.exe") and
       process.code_signature.subject_name in ("Veeam Software Group GmbH", "Veeam Software AG") and process.code_signature.trusted == true) and
  not (process.executable : "C:\\Windows\\System32\\svchost.exe" and process.parent.executable : "C:\\Windows\\System32\\services.exe") and
  not (process.executable : "C:\\Windows\\System32\\svchost.exe" and process.parent.executable : "C:\\Windows\\System32\\services.exe") and
  not process.executable : "C:\\Program Files\\2BrightSparks\\SyncBackPro\\SyncBackPro.exe" and
  not (process.parent.executable : "C:\\Windows\\System32\\cmd.exe" and
      process.command_line : "powershell  -ExecutionPolicy ByPass -FILE \"C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\*.ps1\" ")