On Windows systems, identify when the built-in Shadow Copy utility is used to enumerate existing snapshots. What was the full command executed?

DeviceProcessEvents
| where FileName =~ "vssadmin.exe"
| where ProcessCommandLine has "list shadows"
| project Timestamp, DeviceName, ProcessCommandLine

DeviceProcessEvents
| where FileName == 'vssadmin.exe' and ProcessCommandLine contains 'list shadows'
| project TimeGenerated, DeviceName, ProcessCommandLine

DeviceProcessEvents
| where FileName =~ "vssadmin.exe"
| where ProcessCommandLine has_any ("list shadows", "list shadowstorage")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine

DeviceProcessEvents
| where FileName =~ "vssadmin.exe" and (ProcessCommandLine contains "list" and ProcessCommandLine contains "shad")

DeviceProcessEvents
| where ProcessCommandLine has_any ('vssadmin', 'vssadmin list shadows', 'shadowcopy', 'shadow copy')
| where ProcessCommandLine contains 'list shadows' or ProcessCommandLine contains 'list shadows'
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, InitiatingProcessFileName

DeviceProcessEvents
| where FileName == "vssadmin.exe" and ProcessCommandLine contains "list shadows"
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine

// Shadow Copy enumeration: vssadmin list shadows (and wmic shadowcopy list)
let vss_list = DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName =~ "vssadmin.exe"
| where ProcessCommandLine matches regex @"(?i)\blist\s+shadows?\b";  // enumerate existing snapshots
let wmic_list = DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName =~ "wmic.exe"
| where ProcessCommandLine matches regex @"(?i)\bwmic(\.exe)?\s+shadowcopy\s+list\b";  // alternate enumeration
union vss_list, wmic_list
| project TimeGenerated, DeviceId, DeviceName, AccountDomain, AccountName, FileName, FolderPath, ProcessCommandLine
| extend FullCommand = coalesce(ProcessCommandLine, strcat(FolderPath, "\\", FileName))
| order by TimeGenerated desc

union isfuzzy=true DeviceProcessEvents, DeviceEvents, DeviceFileEvents
| extend CommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
| where isnotempty(CommandLine)
| where (
    (tolower(CommandLine) contains "vssadmin" and (tolower(CommandLine) contains "list" or tolower(CommandLine) contains "shadows" or tolower(CommandLine) contains "shadowstorage"))
    or tolower(CommandLine) contains "wmic shadowcopy"
    or ((tolower(CommandLine) contains "get-wmiobject" or tolower(CommandLine) contains "get-ciminstance" or tolower(CommandLine) contains "gwmi") and tolower(CommandLine) contains "shadow")
)
| project TimeGenerated, DeviceName, AccountName = coalesce(InitiatingProcessAccountName, AccountName), UserPrincipal = coalesce(InitiatingProcessAccountUpn, AccountUpn), ProcessId = coalesce(ProcessId, InitiatingProcessId), FileName = coalesce(FileName, InitiatingProcessFileName), CommandLine, ReportId, TenantId
| sort by TimeGenerated desc

union DeviceProcessEvents, DeviceEvents, DeviceFileEvents, DeviceImageLoadEvents
| where FileName has_any ("vssadmin.exe", "diskshadow.exe", "wmic.exe")
    or ProcessCommandLine has_any ("vssadmin", "diskshadow", "list shadows", "list shadow", "shadowcopy", "shadowcopies", "wmic shadowcopy", "shadow copy")
    or InitiatingProcessCommandLine has_any ("vssadmin", "diskshadow", "list shadows", "list shadow", "shadowcopy", "shadowcopies", "wmic shadowcopy", "shadow copy")
| extend EventTime = coalesce(TimeGenerated, Timestamp)
| extend FullCommand = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
// Keep records that are likely to be enumerating snapshots
| where FullCommand has_any ("list shadows", "shadowcopy", "shadowcopies") or FileName has_any ("vssadmin.exe", "diskshadow.exe")
| project EventTime, DeviceName, Account = coalesce(InitiatingProcessAccountName, AccountName), FileName, ProcessId = coalesce(ProcessId, InitiatingProcessId), InitiatingProcessFileName, FullCommand, ReportId
| sort by EventTime desc

// Detect usage of vssadmin to enumerate shadows
let lookback = 30d; // actual time range will be set by caller/timepicker
let p1 = DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where tolower(InitiatingProcessFileName) has "vssadmin" or tolower(ProcessCommandLine) has "vssadmin"
| where tolower(InitiatingProcessCommandLine) has "list" or tolower(InitiatingProcessCommandLine) has "shadows" or tolower(ProcessCommandLine) has "list" or tolower(ProcessCommandLine) has "shadows"
| extend FullCommand = coalesce(InitiatingProcessCommandLine, ProcessCommandLine)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessFileName, FullCommand, ReportId, TenantId, SourceSystem, _ResourceId;
let p2 = DeviceEvents
| where TimeGenerated >= ago(lookback)
| where tolower(FileName) has "vssadmin" or tolower(ProcessCommandLine) has "vssadmin" or tolower(InitiatingProcessFileName) has "vssadmin"
| extend FullCommand = coalesce(ProcessCommandLine, InitiatingProcessCommandLine, AdditionalFields.CommandLine, tostring(AdditionalFields.CommandLine))
| where tolower(FullCommand) has "list" or tolower(FullCommand) has "shadows"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessId = coalesce(InitiatingProcessId, ProcessId), InitiatingProcessFileName = coalesce(InitiatingProcessFileName, FileName), FullCommand, ReportId, TenantId, SourceSystem, _ResourceId;
union p1, p2
| sort by TimeGenerated desc
| distinct TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessFileName, FullCommand, ReportId, TenantId, SourceSystem, _ResourceId
| where isnotempty(FullCommand)
| extend CommandLower = tolower(FullCommand)
| where CommandLower has "vssadmin" and (CommandLower has "list" or CommandLower has "shadows" or CommandLower has "shadow")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessFileName, FullCommand
| take 100

DeviceProcessEvents
| where InitiatingProcessFileName contains "vssadmin" or tolower(InitiatingProcessCommandLine) contains "vssadmin"
| where tolower(InitiatingProcessCommandLine) contains "list shadows"
| extend FullCommand = InitiatingProcessCommandLine
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, FullCommand
| sort by TimeGenerated desc

let timeWindow = 1d;
DeviceProcessEvents
| where TimeGenerated >= ago(timeWindow)
| where InitiatingProcessCommandLine has_cs "vssadmin" and InitiatingProcessCommandLine has_cs "list" and InitiatingProcessCommandLine has_cs "shadows"
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine

DeviceProcessEvents
| where FileName == 'vssadmin.exe' and ProcessCommandLine contains 'list shadows'
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc

DeviceProcessEvents
| where FileName == "vssadmin.exe"
| where tolower(ProcessCommandLine) contains "list shadows"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp desc

DeviceProcessEvents
| where tolower(FileName) == "vssadmin.exe" or tolower(InitiatingProcessFileName) == "vssadmin.exe"
| where tolower(ProcessCommandLine) has "list shadows" or tolower(InitiatingProcessCommandLine) has "list shadows"
| extend fullCommand = iif(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine)
| project TimeGenerated, DeviceName, fullCommand
| order by TimeGenerated desc

DeviceProcessEvents
| where (InitiatingProcessFileName =~ "vssadmin.exe" or FileName =~ "vssadmin.exe")
| where tolower(iif(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine)) contains "list shadows"
| project TimeGenerated, DeviceName, FullCommand = iif(isnotempty(ProcessCommandLine), ProcessCommandLine, InitiatingProcessCommandLine)
| order by TimeGenerated desc

let ShadowTools = dynamic(["vssadmin.exe","diskshadow.exe","wmic.exe"]);
DeviceProcessEvents
| where FileName in~ (ShadowTools)
| where ProcessCommandLine matches regex @"(?i)\b(list|get|enum)\b.*\b(shadow|shadowcopy)s?\b"
| project TimeGenerated, DeviceName, User = InitiatingProcessAccountName, Executable = FileName, CommandLine = ProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
// Filter for built-in Shadow Copy utilities
| where FileName in ("vssadmin.exe", "diskshadow.exe")
// Look for commands that enumerate snapshots
| where tolower(ProcessCommandLine) has "list shadows"
// Project the relevant details
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine
| sort by TimeGenerated desc