(((Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\wmic.exe OR Image:\\vssadmin.exe OR Image:\\diskshadow.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll OR OriginalFileName:wmic.exe OR OriginalFileName:VSSADMIN.EXE OR OriginalFileName:diskshadow.exe)) (CommandLine:shadow* CommandLine:delete*)) OR ((Image:\\wbadmin.exe OR OriginalFileName:WBADMIN.EXE) (CommandLine:delete* CommandLine:catalog* CommandLine:quiet*)) OR ((Image:\\vssadmin.exe OR OriginalFileName:VSSADMIN.EXE) ((CommandLine:resize* CommandLine:shadowstorage*) (CommandLine:unbounded* OR CommandLine:\/MaxSize=*)))