Detection: WBAdmin Delete System Backups
Description
This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery.
Annotations
No annotations available.
Implementation
To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint_Processess datamodel.
Known False Positives
Administrators may modify the boot configuration.
Associated Analytic Story
Risk Based Analytics (RBA)
| Risk Message | Risk Score | Impact | Confidence |
|---|---|---|---|
| An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system backups. | 15 | 30 | 50 |
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
References
-
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
-
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
Version: 4