Windows Backup File Deletion Triggered by CLI or Script Hosts

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1490Inhibit System Recovery

What it detects

This rule identifies deletion activity where a process invoked via cmd.exe, PowerShell, pwsh, wt.exe, rundll32.exe, or regsvr32.exe targets files with backup-related extensions. Attackers may remove or disrupt backup artifacts to hinder system recovery and reduce the chance of restoring from known-good data. Telemetry relies on Windows process execution context and file deletion events capturing Image and TargetFilename with the specified extensions.

Reporting behind it

Related detections9 linkedT1490 — drag to rearrange

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

Malicious Volume Shadow Copy Deletion via vssadmin

Suspicious Free Space Wipe via cipher.exe

Malicious Shadow Copy Deletion Via WMI

Volume Shadow Copy Deletion via vssadmin or wmic

Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)

Malicious Shadow Copy Deletion via vssadmin

Windows Backup File Deletion Triggered by CLI or Script Hosts

Pivot detection · T1490 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-deletion-of-backup-file-extensions-via-command-line-binaries-06125661

title: Windows Backup File Deletion Triggered by CLI or Script Hosts
id: a11a0e6e-b246-45cc-a8f5-add9dae6a6e8
status: test
description: This rule identifies deletion activity where a process invoked via cmd.exe, PowerShell, pwsh, wt.exe, rundll32.exe, or regsvr32.exe targets files with backup-related extensions. Attackers may remove or disrupt backup artifacts to hinder system recovery and reduce the chance of restoring from known-good data. Telemetry relies on Windows process execution context and file deletion events capturing Image and TargetFilename with the specified extensions.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_backup_file.yml
author: frack113, Huntrule Team
date: 2022-01-02
modified: 2023-02-15
tags:
  - attack.impact
  - attack.t1490
logsource:
  product: windows
  category: file_delete
detection:
  selection:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \wt.exe
      - \rundll32.exe
      - \regsvr32.exe
    TargetFilename|endswith:
      - .VHD
      - .bac
      - .bak
      - .wbcat
      - .bkf
      - .set
      - .win
      - .dsk
  condition: selection
falsepositives:
  - Legitimate usage
level: medium
license: DRL-1.1
related:
  - id: 06125661-3814-4e03-bfa2-1e4411c60ac3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL