Windows Backup Deleted Via Wbadmin.EXE (89f75308-5b1b-4390-b2d8-d6b2340efaf8)
Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Windows Backup Deleted Via Wbadmin.EXE (89f75308-5b1b-4390-b2d8-d6b2340efaf8) | Sigma-Rules | Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a) | Attack Pattern | 1 |