Hayabusa medium test sigma

Windows Backup Deleted Via Wbadmin.EXE

Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_img": [
    {
      "NewProcessName
| endswith": "\\wbadmin.exe"
    },
    {
      "OriginalFileName": "WBADMIN.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine
| contains
| all": [
      "delete ",
      "backup"
    ]
  },
  "filter_main_keep_versions": {
    "CommandLine
| contains": "keepVersions:0"
  },
  "condition": "process_creation and (all of selection_* and not 1 of filter_main_*)"
}

False Positives

⚠ Legitimate backup activity from administration scripts and software.

Field Validations

Loading…

Comments (0)

Loading comments...