Windows wbadmin.exe Deletes All Backup Copies (keepVersions:0)

title: Windows wbadmin.exe Deletes All Backup Copies (keepVersions:0)
id: e1ba375e-82c2-4f6a-98f0-547d6d35b827
related:
  - id: 89f75308-5b1b-4390-b2d8-d6b2340efaf8
    type: derived
  - id: 639c9081-f482-47d3-a0bd-ddee3d4ecd76
    type: derived
status: test
description: This rule identifies command-line executions of wbadmin.exe on Windows where backup or system state backup deletion is requested with keepVersions:0. Attackers may remove all available backups to hinder recovery after impact. Detection relies on process creation telemetry, specifically the executed image name/path and the presence of deletion-related parameters in the command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
  - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
  - https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/
  - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted
  - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-13
modified: 2024-05-10
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wbadmin.exe
    - OriginalFileName: WBADMIN.EXE
  selection_cli:
    CommandLine|contains|all:
      - delete
      - backup
    CommandLine|contains: keepVersions:0
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1