{"id":"8b93a509-1cb8-42e1-97aa-ee24224cdc15","title":"Sensitive File Dump Via Wbadmin.EXE","description":"Detects the dump of highly sensitive files such as \"NTDS.DIT\" and \"SECURITY\" hive.\nAttackers can leverage the \"wbadmin\" utility in order to dump sensitive files that might contain credential or sensitive information.\n","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"high","date":"2024-05-10","modified":"","tags":["attack.credential-access","attack.t1003.003"],"technique_ids":["T1003.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate backup operation by authorized administrators. Matches must be investigated and allowed on a case by case basis."],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml","https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup"],"source_path":"rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml","source_sha256":"38d1461eb2bcfdd6824f140c51e2ad881c1889b73ef8dfa28ca63bfee646aa69","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Sensitive File Dump Via Wbadmin.EXE\nid: 8b93a509-1cb8-42e1-97aa-ee24224cdc15\nstatus: test\ndescription: |\n    Detects the dump of highly sensitive files such as \"NTDS.DIT\" and \"SECURITY\" hive.\n    Attackers can leverage the \"wbadmin\" utility in order to dump sensitive files that might contain credential or sensitive information.\nreferences:\n    - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml\n    - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup\nauthor: Nasreddine Bencherchali (Nextron Systems), frack113\ndate: 2024-05-10\ntags:\n    - attack.credential-access\n    - attack.t1003.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\wbadmin.exe'\n        - OriginalFileName: 'WBADMIN.EXE'\n    selection_backup:\n        CommandLine|contains:\n            - 'start'\n            - 'backup'\n    selection_path:\n        CommandLine|contains:\n            - '\\config\\SAM'\n            - '\\config\\SECURITY'\n            - '\\config\\SYSTEM'\n            - '\\Windows\\NTDS\\NTDS.dit'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate backup operation by authorized administrators. Matches must be investigated and allowed on a case by case basis.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.003","id":"T1003.003","name":"NTDS","page":"techniques/enterprise/T1003.003/"}],"data_path":"data/detection-rules/8b93a509-1cb8-42e1-97aa-ee24224cdc15.json","kind":"sigma"}