Shadow Copy Deletions

This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by TA. This query detects know commands that have been used by the ransomware actors. Some information from Mitre Attack: https://attack.mitre.org/techniques/T1490/