{"id":"6fe4aa1e-0531-4510-8be2-782154b73b48","title":"File Recovery From Backup Via Wbadmin.EXE","description":"Detects the recovery of files from backups via \"wbadmin.exe\".\nAttackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.\n","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2024-05-10","modified":"","tags":["attack.impact","attack.t1490"],"technique_ids":["T1490"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery","https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/"],"source_path":"rules/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml","source_sha256":"0f90c701c4dda5b6b434243b7fa92df2f7af666e469e51528c18c47371918306","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: File Recovery From Backup Via Wbadmin.EXE\nid: 6fe4aa1e-0531-4510-8be2-782154b73b48\nrelated:\n    - id: 84972c80-251c-4c3a-9079-4f00aad93938\n      type: derived\nstatus: test\ndescription: |\n    Detects the recovery of files from backups via \"wbadmin.exe\".\n    Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.\nreferences:\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery\n    - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/\nauthor: Nasreddine Bencherchali (Nextron Systems), frack113\ndate: 2024-05-10\ntags:\n    - attack.impact\n    - attack.t1490\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\wbadmin.exe'\n        - OriginalFileName: 'WBADMIN.EXE'\n    selection_cli:\n        CommandLine|contains|all:\n            - ' recovery'\n            - 'recoveryTarget'\n            - 'itemtype:File'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1490","id":"T1490","name":"Inhibit System Recovery","page":"techniques/enterprise/T1490/"}],"data_path":"data/detection-rules/6fe4aa1e-0531-4510-8be2-782154b73b48.json","kind":"sigma"}