File Recovery From Backup Via Wbadmin.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•14

This rule detects the use of 'wbadmin.exe' to recover files from backups. Adversaries may use this technique to restore sensitive files, such as NTDS.DIT (Active Directory database) or Registry Hives, from backups. These files can then be analyzed offline to extract credentials or other sensitive information, potentially leading to further compromise.