huntrule

Windows Process: File Recovery from Backup via wbadmin.exe

Flags wbadmin.exe executions that perform file recovery from backups based on recoveryTarget and itemtype:File arguments.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published
2024-05-10
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows process executions of wbadmin.exe used to recover files from backups, matching command-line arguments for recoveryTarget and itemtype:File. Attackers may use this functionality to restore sensitive artifacts from backup media in support of credential access and other post-compromise objectives. The detection relies on process creation telemetry, specifically the executable name/path and the presence of recovery-related parameters in the command line.

Reporting behind it

Related detections9 linkedT1490 — drag to rearrange
Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware
Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware
Malicious Volume Shadow Copy Deletion via vssadmin or WMIC
Malicious Volume Shadow Copy Deletion via vssadmin
Suspicious Free Space Wipe via cipher.exe
Malicious Shadow Copy Deletion Via WMI
Volume Shadow Copy Deletion via vssadmin or wmic
Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)
Malicious Shadow Copy Deletion via vssadmin
Windows Process: File Recovery from Backup via wbadmin.exe
Pivot detection · T1490 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.