//CW - VSSadmin delete shadows alert
let ExpectedActivityParentFile =  pack_array(
    "placeholdervalue" //<--replace with exceptions, comma separated
);
DeviceProcessEvents
| where InitiatingProcessFileName !in~ (ExpectedActivityParentFile)
| where FileName == "vssadmin.exe"
| extend tempvalue1=replace(@'["`]',"",ProcessCommandLine)
| extend cleanedCommandLine=replace(@"[']","",tempvalue1)
| where cleanedCommandLine contains "delete" //note: contains is case insensitive unless it's followed by _cs
| extend RoundedTime = bin(Timestamp, 5m)
| summarize any(Timestamp, FileName, FolderPath, AccountName, AccountUpn, InitiatingProcessFileName, InitiatingProcessFolderPath, DeviceId) by RoundedTime, DeviceName, ProcessCommandLine
| project Timestamp=any_Timestamp, DeviceName, FileName=any_FileName, ProcessCommandLine, FolderPath=any_FolderPath, AccountName=any_AccountName, AccountUpn=any_AccountUpn, InitiatingProcessFileName=any_InitiatingProcessFileName, InitiatingProcessFolderPath=any_InitiatingProcessFolderPath, DeviceId=any_DeviceId
| sort by Timestamp desc