Update process_creation_shadow_copies_deletion.yml

rules/windows/process_creation/process_creation_shadow_copies_deletion.yml

@@ -8,16 +8,18 @@ references:
     - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/
 tags:
     - attack.defense_evasion
+    - attack.impact
     - attack.t1070
+    - attack.t1490
 logsource:
     category: process_creation
     product: windows
 detection:
     selection:
-        NewProcessName:
-            - '*\powershell.exe'
-            - '*\wmic.exe'
-            - '*\vssadmin.exe'
+        NewProcessName|endswith:
+            - '\powershell.exe'
+            - '\wmic.exe'
+            - '\vssadmin.exe'
         CommandLine|contains|all:
             - shadow
             - delete