{"id":"89f75308-5b1b-4390-b2d8-d6b2340efaf8","title":"Windows Backup Deleted Via Wbadmin.EXE","description":"Detects the deletion of backups or system state backups via \"wbadmin.exe\".\nThis technique is used by numerous ransomware families and actors.\nThis may only be successful on server platforms that have Windows Backup enabled.\n","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2021-12-13","modified":"2024-05-10","tags":["attack.impact","attack.t1490"],"technique_ids":["T1490"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate backup activity from administration scripts and software."],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell","https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md","https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/","https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup"],"source_path":"rules/windows/process_creation/proc_creation_win_wbadmin_delete_backups.yml","source_sha256":"1e81e1d0e311231548a94fbfa7fe22b171b0888ea2e9ccf286ed8ce000049055","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wbadmin_delete_backups.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Backup Deleted Via Wbadmin.EXE\nid: 89f75308-5b1b-4390-b2d8-d6b2340efaf8\nrelated:\n    - id: 639c9081-f482-47d3-a0bd-ddee3d4ecd76\n      type: derived\nstatus: test\ndescription: |\n    Detects the deletion of backups or system state backups via \"wbadmin.exe\".\n    This technique is used by numerous ransomware families and actors.\n    This may only be successful on server platforms that have Windows Backup enabled.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell\n    - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md\n    - https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/\n    - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted\n    - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup\nauthor: frack113, Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-12-13\nmodified: 2024-05-10\ntags:\n    - attack.impact\n    - attack.t1490\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\wbadmin.exe'\n        - OriginalFileName: 'WBADMIN.EXE'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'delete '\n            - 'backup' # Also covers \"SYSTEMSTATEBACKUP\"\n    filter_main_keep_versions:\n        # Note: We exclude this to avoid duplicate alerts with 639c9081-f482-47d3-a0bd-ddee3d4ecd76\n        CommandLine|contains: 'keepVersions:0'\n    condition: all of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate backup activity from administration scripts and software.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1490","id":"T1490","name":"Inhibit System Recovery","page":"techniques/enterprise/T1490/"}],"data_path":"data/detection-rules/89f75308-5b1b-4390-b2d8-d6b2340efaf8.json","kind":"sigma"}