let RecoveryTamperCommands = dynamic([
'vssadmin.exe delete shadows /all /quiet',
'wmic.exe shadowcopy delete',
'wbadmin delete catalog -quiet',
'wbadmin delete systemstatebackup -keepVersions:0',
'Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}',
'bcdedit /set {default} recoveryenabled no'
]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any (RecoveryTamperCommands)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc