{"id":"84972c80-251c-4c3a-9079-4f00aad93938","title":"Sensitive File Recovery From Backup Via Wbadmin.EXE","description":"Detects the dump of highly sensitive files such as \"NTDS.DIT\" and \"SECURITY\" hive.\nAttackers can leverage the \"wbadmin\" utility in order to dump sensitive files that might contain credential or sensitive information.\n","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"high","date":"2024-05-10","modified":"","tags":["attack.credential-access","attack.t1003.003"],"technique_ids":["T1003.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml","https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup"],"source_path":"rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml","source_sha256":"8a48de5af417debaa994ce13618bc71c89eee5ab2bc08308e0a5db204c1d34f3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Sensitive File Recovery From Backup Via Wbadmin.EXE\nid: 84972c80-251c-4c3a-9079-4f00aad93938\nrelated:\n    - id: 6fe4aa1e-0531-4510-8be2-782154b73b48\n      type: derived\nstatus: test\ndescription: |\n    Detects the dump of highly sensitive files such as \"NTDS.DIT\" and \"SECURITY\" hive.\n    Attackers can leverage the \"wbadmin\" utility in order to dump sensitive files that might contain credential or sensitive information.\nreferences:\n    - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml\n    - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup\nauthor: Nasreddine Bencherchali (Nextron Systems), frack113\ndate: 2024-05-10\ntags:\n    - attack.credential-access\n    - attack.t1003.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\wbadmin.exe'\n        - OriginalFileName: 'WBADMIN.EXE'\n    selection_backup:\n        CommandLine|contains|all:\n            - ' recovery'\n            - 'recoveryTarget'\n            - 'itemtype:File'\n        CommandLine|contains:\n            - '\\config\\SAM'\n            - '\\config\\SECURITY'\n            - '\\config\\SYSTEM'\n            - '\\Windows\\NTDS\\NTDS.dit'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.003","id":"T1003.003","name":"NTDS","page":"techniques/enterprise/T1003.003/"}],"data_path":"data/detection-rules/84972c80-251c-4c3a-9079-4f00aad93938.json","kind":"sigma"}