Elastic low stable eql

Backup Deletion with Wbadmin

Detects use of wbadmin.exe to delete backup catalogs, system state backups, or other backup data. Ransomware and other malware may do this to prevent system recovery.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
  (process.name : "wbadmin.exe" or ?process.pe.original_file_name == "WBADMIN.EXE") and
  process.args : ("catalog", "backup", "systemstatebackup") and process.args : "delete"

Field Validations

Loading…

Comments (0)

Loading comments...