Windows Backup Catalog Deletion (Microsoft-Windows-Backup Event 524)

title: Windows Backup Catalog Deletion (Microsoft-Windows-Backup Event 524)
id: 213e9b3f-74eb-4623-b019-43835b02235e
status: test
description: This rule flags deletion of the Windows backup catalog as reported by the Microsoft-Windows-Backup provider (Event ID 524). Attackers may attempt to remove or tamper with backup metadata to reduce recovery options or hinder forensic reconstruction. The detection relies on Windows application telemetry from the Microsoft-Windows-Backup event stream, specifically the presence of Event ID 524.
references:
  - https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx
  - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml
author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), Huntrule Team
date: 2017-05-12
modified: 2022-12-25
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  product: windows
  service: application
detection:
  selection:
    EventID: 524
    Provider_Name: Microsoft-Windows-Backup
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9703792d-fd9a-456d-a672-ff92efe4806a
    type: derived