{"id":"639c9081-f482-47d3-a0bd-ddee3d4ecd76","title":"All Backups Deleted Via Wbadmin.EXE","description":"Detects the deletion of all backups or system state backups via \"wbadmin.exe\".\nThis technique is used by numerous ransomware families and actors.\nThis may only be successful on server platforms that have Windows Backup enabled.\n","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-12-13","modified":"2024-05-10","tags":["attack.impact","attack.t1490"],"technique_ids":["T1490"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell","https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md","https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/","https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup"],"source_path":"rules/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml","source_sha256":"f620d030d052acf999e6509bd15826241fee4d6870df5748a82c4bf2bf1ff072","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: All Backups Deleted Via Wbadmin.EXE\nid: 639c9081-f482-47d3-a0bd-ddee3d4ecd76\nrelated:\n    - id: 89f75308-5b1b-4390-b2d8-d6b2340efaf8\n      type: derived\nstatus: test\ndescription: |\n    Detects the deletion of all backups or system state backups via \"wbadmin.exe\".\n    This technique is used by numerous ransomware families and actors.\n    This may only be successful on server platforms that have Windows Backup enabled.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell\n    - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md\n    - https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/\n    - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted\n    - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup\nauthor: frack113, Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-12-13\nmodified: 2024-05-10\ntags:\n    - attack.impact\n    - attack.t1490\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\wbadmin.exe'\n        - OriginalFileName: 'WBADMIN.EXE'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'delete'\n            - 'backup' # Also covers \"SYSTEMSTATEBACKUP\"\n        CommandLine|contains: 'keepVersions:0'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1490","id":"T1490","name":"Inhibit System Recovery","page":"techniques/enterprise/T1490/"}],"data_path":"data/detection-rules/639c9081-f482-47d3-a0bd-ddee3d4ecd76.json","kind":"sigma"}