Sensitive File Recovery From Backup Via Wbadmin.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•13

Detects the use of 'wbadmin.exe' to recover highly sensitive files such as 'NTDS.DIT', 'SAM', 'SECURITY', and 'SYSTEM' hives. Attackers can leverage this utility to dump sensitive files that might contain credential or other sensitive information.