Windows Process: File Recovery from Backup via wbadmin.exe
Flags wbadmin.exe executions that perform file recovery from backups based on recoveryTarget and itemtype:File arguments.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2024-05-10
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies Windows process executions of wbadmin.exe used to recover files from backups, matching command-line arguments for recoveryTarget and itemtype:File. Attackers may use this functionality to restore sensitive artifacts from backup media in support of credential access and other post-compromise objectives. The detection relies on process creation telemetry, specifically the executable name/path and the presence of recovery-related parameters in the command line.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process: File Recovery from Backup via wbadmin.exe"
id: 9c8fc675-2dac-4f38-b4e8-07e7d409b2ec
related:
- id: 84972c80-251c-4c3a-9079-4f00aad93938
type: derived
- id: 6fe4aa1e-0531-4510-8be2-782154b73b48
type: derived
status: test
description: This rule identifies Windows process executions of wbadmin.exe used to recover files from backups, matching command-line arguments for recoveryTarget and itemtype:File. Attackers may use this functionality to restore sensitive artifacts from backup media in support of credential access and other post-compromise objectives. The detection relies on process creation telemetry, specifically the executable name/path and the presence of recovery-related parameters in the command line.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
- https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2024-05-10
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \wbadmin.exe
- OriginalFileName: WBADMIN.EXE
selection_cli:
CommandLine|contains|all:
- " recovery"
- recoveryTarget
- itemtype:File
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1