VSS backup deletion (WMI)

Detects scenarios where an attacker attempts to delete existing VSS backup.