Windows: wbadmin.exe Used to Recover/Dump Sensitive Registry Hives and NTDS.dit

Alert on wbadmin.exe recovery commands targeting SAM/SECURITY/SYSTEM hives and NTDS.dit.

FreeUnreviewedSigmahighv1

windows-wbadmin-exe-used-to-recover-dump-sensitive-registry-hives-and-ntds-dit-84972c80

title: "Windows: wbadmin.exe Used to Recover/Dump Sensitive Registry Hives and NTDS.dit"
id: 708fa03c-54f1-4c83-b579-ff045bc555cd
related:
  - id: 6fe4aa1e-0531-4510-8be2-782154b73b48
    type: derived
  - id: 84972c80-251c-4c3a-9079-4f00aad93938
    type: derived
status: test
description: This rule flags process executions of wbadmin.exe where the command line indicates a file recovery operation targeting sensitive artifacts. It matches recovery parameters and item type for files, along with paths for the SAM, SECURITY, SYSTEM hives and the NTDS.dit file. Such activity matters because recovering or dumping these files can expose credentials and other sensitive directory data. The detection relies on Windows process creation telemetry, including Image/OriginalFileName and the full CommandLine.
references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
  - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2024-05-10
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wbadmin.exe
    - OriginalFileName: WBADMIN.EXE
  selection_backup:
    CommandLine|contains|all:
      - " recovery"
      - recoveryTarget
      - itemtype:File
    CommandLine|contains:
      - \config\SAM
      - \config\SECURITY
      - \config\SYSTEM
      - \Windows\NTDS\NTDS.dit
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags process executions of wbadmin.exe where the command line indicates a file recovery operation targeting sensitive artifacts. It matches recovery parameters and item type for files, along with paths for the SAM, SECURITY, SYSTEM hives and the NTDS.dit file. Such activity matters because recovering or dumping these files can expose credentials and other sensitive directory data. The detection relies on Windows process creation telemetry, including Image/OriginalFileName and the full CommandLine.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.