Windows Process: File Recovery from Backup via wbadmin.exe

title: "Windows Process: File Recovery from Backup via wbadmin.exe"
id: 9c8fc675-2dac-4f38-b4e8-07e7d409b2ec
related:
  - id: 84972c80-251c-4c3a-9079-4f00aad93938
    type: derived
  - id: 6fe4aa1e-0531-4510-8be2-782154b73b48
    type: derived
status: test
description: This rule identifies Windows process executions of wbadmin.exe used to recover files from backups, matching command-line arguments for recoveryTarget and itemtype:File. Attackers may use this functionality to restore sensitive artifacts from backup media in support of credential access and other post-compromise objectives. The detection relies on process creation telemetry, specifically the executable name/path and the presence of recovery-related parameters in the command line.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
  - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2024-05-10
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wbadmin.exe
    - OriginalFileName: WBADMIN.EXE
  selection_cli:
    CommandLine|contains|all:
      - " recovery"
      - recoveryTarget
      - itemtype:File
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1