Windows Backup Deleted Via Wbadmin.EXE

Title: Windows Backup Deleted Via Wbadmin.EXE
Status: test
Description:Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
  -https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
  -https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/
  -https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted
  -https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-13
modified:2024-05-10
Tags:

• -'attack.impact'
• -'attack.t1490'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\wbadmin.exe' OriginalFileName:'WBADMIN.EXE'   selection_cli:
    CommandLine|contains|all:
      -'delete '
      -'backup'

  filter_main_keep_versions:
    CommandLine|contains: 'keepVersions:0'
  condition:all of selection_* and not 1 of filter_main_*
Falsepositives:
  -Legitimate backup activity from administration scripts and software.
Level: medium