Windows: Delete Backup or System State Backups via wbadmin.exe
Flags wbadmin.exe command lines that delete backup or system state backups, potentially impacting recovery.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-12-13
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies process executions of wbadmin.exe where the command line includes deletion of backups, including system state backups. Deleting local backups or system state backups can reduce an environment’s ability to recover and is commonly used to inhibit incident response. It relies on Windows process creation telemetry with the executable path and the command-line content indicating a delete operation.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
- github.comhttps://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
- sentinelone.comhttps://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/
- trendmicro.comhttps://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted
- trendmicro.comhttps://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_delete_backups.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-delete-backup-or-system-state-backups-via-wbadmin-exe-89f75308
title: "Windows: Delete Backup or System State Backups via wbadmin.exe"
id: cae602b7-164b-4289-8bb4-6f5a49103d47
related:
- id: 639c9081-f482-47d3-a0bd-ddee3d4ecd76
type: derived
- id: 89f75308-5b1b-4390-b2d8-d6b2340efaf8
type: derived
status: test
description: This rule identifies process executions of wbadmin.exe where the command line includes deletion of backups, including system state backups. Deleting local backups or system state backups can reduce an environment’s ability to recover and is commonly used to inhibit incident response. It relies on Windows process creation telemetry with the executable path and the command-line content indicating a delete operation.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
- https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
- https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_delete_backups.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-13
modified: 2024-05-10
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \wbadmin.exe
- OriginalFileName: WBADMIN.EXE
selection_cli:
CommandLine|contains|all:
- "delete "
- backup
filter_main_keep_versions:
CommandLine|contains: keepVersions:0
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Legitimate backup activity from administration scripts and software.
level: medium
license: DRL-1.1