Detectionmediumtest

Backup Catalog Deleted

Detects backup catalog deletions

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems), Tom U. (collection)Created Fri May 12Updated Sun Dec 259703792d-fd9a-456d-a672-ff92efe4806awindows

Log Source

Windowsapplication

ProductWindows← raw: windows

Serviceapplication← raw: application

Detection Logic

detection:
    selection:
        EventID: 524
        Provider_Name: Microsoft-Windows-Backup
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

9703792d-fd9a-456d-a672-ff92efe4806a

Status

test

Level

medium

Type

Detection

Created

Fri May 12

Modified

Sun Dec 25

Author

Path

rules/windows/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml

Raw Tags

attack.defense-evasionattack.t1070.004