Windows: wbadmin.exe Used to Recover/Dump Sensitive Registry Hives and NTDS.dit
Alert on wbadmin.exe recovery commands targeting SAM/SECURITY/SYSTEM hives and NTDS.dit.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2024-05-10
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of wbadmin.exe where the command line indicates a file recovery operation targeting sensitive artifacts. It matches recovery parameters and item type for files, along with paths for the SAM, SECURITY, SYSTEM hives and the NTDS.dit file. Such activity matters because recovering or dumping these files can expose credentials and other sensitive directory data. The detection relies on Windows process creation telemetry, including Image/OriginalFileName and the full CommandLine.
Reporting behind it
- github.comhttps://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: wbadmin.exe Used to Recover/Dump Sensitive Registry Hives and NTDS.dit"
id: 708fa03c-54f1-4c83-b579-ff045bc555cd
related:
- id: 6fe4aa1e-0531-4510-8be2-782154b73b48
type: derived
- id: 84972c80-251c-4c3a-9079-4f00aad93938
type: derived
status: test
description: This rule flags process executions of wbadmin.exe where the command line indicates a file recovery operation targeting sensitive artifacts. It matches recovery parameters and item type for files, along with paths for the SAM, SECURITY, SYSTEM hives and the NTDS.dit file. Such activity matters because recovering or dumping these files can expose credentials and other sensitive directory data. The detection relies on Windows process creation telemetry, including Image/OriginalFileName and the full CommandLine.
references:
- https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
- https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2024-05-10
tags:
- attack.credential-access
- attack.t1003.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \wbadmin.exe
- OriginalFileName: WBADMIN.EXE
selection_backup:
CommandLine|contains|all:
- " recovery"
- recoveryTarget
- itemtype:File
CommandLine|contains:
- \config\SAM
- \config\SECURITY
- \config\SYSTEM
- \Windows\NTDS\NTDS.dit
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1