Windows: Deletion of Backup-File Extensions via Command-Line Binaries

Alerts when cmd.exe, PowerShell, wt.exe, rundll32.exe, or regsvr32.exe delete files with backup-oriented filename extensions.

FreeUnreviewedSigmamediumv1

windows-deletion-of-backup-file-extensions-via-command-line-binaries-06125661

title: "Windows: Deletion of Backup-File Extensions via Command-Line Binaries"
id: a11a0e6e-b246-45cc-a8f5-add9dae6a6e8
status: test
description: This rule matches file deletions where the target filename ends with common backup-related extensions (e.g., .bak, .bkf, .dsk, .VHD) and the initiating process is one of cmd.exe, PowerShell (powershell.exe/pwsh.exe), wscript (wt.exe), rundll32.exe, or regsvr32.exe. Attackers may remove backup artifacts to reduce the ability to recover from system changes, sabotage restoration, or impede incident response. It relies on Windows telemetry that records process image names and the targeted file name for delete operations.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_backup_file.yml
author: frack113, Huntrule Team
date: 2022-01-02
modified: 2023-02-15
tags:
  - attack.impact
  - attack.t1490
logsource:
  product: windows
  category: file_delete
detection:
  selection:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \wt.exe
      - \rundll32.exe
      - \regsvr32.exe
    TargetFilename|endswith:
      - .VHD
      - .bac
      - .bak
      - .wbcat
      - .bkf
      - .set
      - .win
      - .dsk
  condition: selection
falsepositives:
  - Legitimate usage
level: medium
license: DRL-1.1
related:
  - id: 06125661-3814-4e03-bfa2-1e4411c60ac3
    type: derived

What it detects

This rule matches file deletions where the target filename ends with common backup-related extensions (e.g., .bak, .bkf, .dsk, .VHD) and the initiating process is one of cmd.exe, PowerShell (powershell.exe/pwsh.exe), wscript (wt.exe), rundll32.exe, or regsvr32.exe. Attackers may remove backup artifacts to reduce the ability to recover from system changes, sabotage restoration, or impede incident response. It relies on Windows telemetry that records process image names and the targeted file name for delete operations.

Known false positives

Legitimate usage

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.