huntrule

Windows: Delete Backup or System State Backups via wbadmin.exe

Flags wbadmin.exe command lines that delete backup or system state backups, potentially impacting recovery.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-12-13
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process executions of wbadmin.exe where the command line includes deletion of backups, including system state backups. Deleting local backups or system state backups can reduce an environment’s ability to recover and is commonly used to inhibit incident response. It relies on Windows process creation telemetry with the executable path and the command-line content indicating a delete operation.

Reporting behind it

Related detections9 linkedT1490 — drag to rearrange
Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware
Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware
Malicious Volume Shadow Copy Deletion via vssadmin or WMIC
Malicious Volume Shadow Copy Deletion via vssadmin
Suspicious Free Space Wipe via cipher.exe
Malicious Shadow Copy Deletion Via WMI
Volume Shadow Copy Deletion via vssadmin or wmic
Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)
Malicious Shadow Copy Deletion via vssadmin
Windows: Delete Backup or System State Backups via wbadmin.exe
Pivot detection · T1490 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.