Windows Process Creation: wbadmin.exe Triggered for Backup of Sensitive Registry and NTDS Files
Alerts on wbadmin.exe backup commands that reference SAM/SECURITY/SYSTEM hives or NTDS.DIT.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2024-05-10
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where wbadmin.exe is used with command-line arguments indicating a backup operation, and where the command line includes paths to sensitive credential-related files. Attackers can abuse wbadmin to obtain high-value data such as the SECURITY, SAM, SYSTEM registry hives and the NTDS.DIT database. Detection relies on Windows process creation telemetry, including the image name (or original filename) and the full command line contents.
Reporting behind it
- github.comhttps://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: wbadmin.exe Triggered for Backup of Sensitive Registry and NTDS Files"
id: c51b4b6a-b3d1-4148-a3f5-7aefedf34f03
status: test
description: This rule flags process creation events where wbadmin.exe is used with command-line arguments indicating a backup operation, and where the command line includes paths to sensitive credential-related files. Attackers can abuse wbadmin to obtain high-value data such as the SECURITY, SAM, SYSTEM registry hives and the NTDS.DIT database. Detection relies on Windows process creation telemetry, including the image name (or original filename) and the full command line contents.
references:
- https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
- https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2024-05-10
tags:
- attack.credential-access
- attack.t1003.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \wbadmin.exe
- OriginalFileName: WBADMIN.EXE
selection_backup:
CommandLine|contains:
- start
- backup
selection_path:
CommandLine|contains:
- \config\SAM
- \config\SECURITY
- \config\SYSTEM
- \Windows\NTDS\NTDS.dit
condition: all of selection_*
falsepositives:
- Legitimate backup operation by authorized administrators. Matches must be investigated and allowed on a case by case basis.
level: high
license: DRL-1.1
related:
- id: 8b93a509-1cb8-42e1-97aa-ee24224cdc15
type: derived