Windows Process Creation: wbadmin.exe Triggered for Backup of Sensitive Registry and NTDS Files

Alerts on wbadmin.exe backup commands that reference SAM/SECURITY/SYSTEM hives or NTDS.DIT.

FreeUnreviewedSigmahighv1

windows-process-creation-wbadmin-exe-triggered-for-backup-of-sensitive-registry--8b93a509

title: "Windows Process Creation: wbadmin.exe Triggered for Backup of Sensitive Registry and NTDS Files"
id: c51b4b6a-b3d1-4148-a3f5-7aefedf34f03
status: test
description: This rule flags process creation events where wbadmin.exe is used with command-line arguments indicating a backup operation, and where the command line includes paths to sensitive credential-related files. Attackers can abuse wbadmin to obtain high-value data such as the SECURITY, SAM, SYSTEM registry hives and the NTDS.DIT database. Detection relies on Windows process creation telemetry, including the image name (or original filename) and the full command line contents.
references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
  - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2024-05-10
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wbadmin.exe
    - OriginalFileName: WBADMIN.EXE
  selection_backup:
    CommandLine|contains:
      - start
      - backup
  selection_path:
    CommandLine|contains:
      - \config\SAM
      - \config\SECURITY
      - \config\SYSTEM
      - \Windows\NTDS\NTDS.dit
  condition: all of selection_*
falsepositives:
  - Legitimate backup operation by authorized administrators. Matches must be investigated and allowed on a case by case basis.
level: high
license: DRL-1.1
related:
  - id: 8b93a509-1cb8-42e1-97aa-ee24224cdc15
    type: derived

What it detects

This rule flags process creation events where wbadmin.exe is used with command-line arguments indicating a backup operation, and where the command line includes paths to sensitive credential-related files. Attackers can abuse wbadmin to obtain high-value data such as the SECURITY, SAM, SYSTEM registry hives and the NTDS.DIT database. Detection relies on Windows process creation telemetry, including the image name (or original filename) and the full command line contents.

Known false positives

Legitimate backup operation by authorized administrators. Matches must be investigated and allowed on a case by case basis.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.