Sensitive File Recovery From Backup Via Wbadmin.EXE — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems), frack113. Source status: test; severity: high. Source dates: 2024-05-10 / not supplied.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 8a48de5af417debaa994ce13618bc71c89eee5ab2bc08308e0a5db204c1d34f3

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Sensitive File Recovery From Backup Via Wbadmin.EXE
id: 84972c80-251c-4c3a-9079-4f00aad93938
related:
    - id: 6fe4aa1e-0531-4510-8be2-782154b73b48
      type: derived
status: test
description: |
    Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
    Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
references:
    - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
    - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
author: Nasreddine Bencherchali (Nextron Systems), frack113
date: 2024-05-10
tags:
    - attack.credential-access
    - attack.t1003.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\wbadmin.exe'
        - OriginalFileName: 'WBADMIN.EXE'
    selection_backup:
        CommandLine|contains|all:
            - ' recovery'
            - 'recoveryTarget'
            - 'itemtype:File'
        CommandLine|contains:
            - '\config\SAM'
            - '\config\SECURITY'
            - '\config\SYSTEM'
            - '\Windows\NTDS\NTDS.dit'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
• https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup