Detectionhightest

All Backups Deleted Via Wbadmin.EXE

Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François Hubaut, Nasreddine Bencherchali (Nextron Systems)Created Mon Dec 13Updated Fri May 10639c9081-f482-47d3-a0bd-ddee3d4ecd76windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\wbadmin.exe'
        - OriginalFileName: 'WBADMIN.EXE'
    selection_cli:
        CommandLine|contains|all:
            - 'delete'
            - 'backup' # Also covers "SYSTEMSTATEBACKUP"
        CommandLine|contains: 'keepVersions:0'
    condition: all of selection_*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0040 · Impact

Techniques

T1490 · Inhibit System Recovery

Related Rules

DerivedDetectionmedium

Windows Backup Deleted Via Wbadmin.EXE

Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

639c9081-f482-47d3-a0bd-ddee3d4ecd76

Status

test

Level

high

Type

Detection

Created

Mon Dec 13

Modified

Fri May 10

Author

François Hubaut, Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml

Raw Tags

attack.impactattack.t1490

View on GitHub