Backup Tamper and Shadow Copy Destruction

let lookback = 14d;
let staging_terms = dynamic(['delete shadows','shadowcopy delete','recoveryenabled no','delete catalog','ignoreallfailures','psexec','process call create','/node:','-enc','encodedcommand']);
let risky_ports = dynamic(['445','3389','5985','5986']);
let proc = DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where ProcessCommandLine has_any (staging_terms)
   or InitiatingProcessFileName in~ ('ScreenConnect.ClientService.exe','ScreenConnect.Service.exe')
   or FileName in~ ('PsExec.exe','wmic.exe','vssadmin.exe','bcdedit.exe','wbadmin.exe','diskshadow.exe')
| project ProcessTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ReportId;
let net = DeviceNetworkEvents
| where TimeGenerated >= ago(lookback)
| where RemotePort in (risky_ports)
| where RemoteIPType !in~ ('Private','Loopback') or ActionType == 'ListeningConnectionSucceeded'
| project NetTime=TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, ActionType, ReportId;
proc
| join kind=leftouter net on DeviceName, ReportId
| extend SuspicionScore = iff(ProcessCommandLine has_any ('delete shadows','recoveryenabled no','delete catalog'), 3, 0) + iff(ProcessCommandLine has_any ('psexec','process call create','/node:'), 2, 0) + iff(InitiatingProcessFileName has 'ScreenConnect', 2, 0)
| where SuspicionScore >= 2
| summarize FirstSeen=min(ProcessTime), LastSeen=max(ProcessTime), max(SuspicionScore), Commands=make_set(ProcessCommandLine, 20), Parents=make_set(InitiatingProcessFileName, 20), RemoteEndpoints=make_set(strcat(RemoteIP,':',RemotePort), 20) by DeviceName, AccountName
| order by max_SuspicionScore desc, LastSeen desc

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.