(CommandLine:Get\-WmiObject* OR CommandLine:gwmi* OR CommandLine:Get\-CimInstance* OR CommandLine:gcim*) CommandLine:Win32_ShadowCopy* (CommandLine:.Delete\(\)* OR CommandLine:Remove\-WmiObject* OR CommandLine:rwmi* OR CommandLine:Remove\-CimInstance* OR CommandLine:rcim*)