Pay2Key Ransomware: wbadmin Backup Deletion and bcdedit Recovery Disable

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects the use of built-in Windows utilities 'wbadmin.exe' and 'bcdedit.exe' with arguments that inhibit system recovery features. Specifically, it monitors for the deletion of the Windows Backup Catalog using 'wbadmin.exe' and the disabling of system recovery/boot failure handling via 'bcdedit.exe'. These actions are commonly performed by ransomware or adversaries to prevent system recovery.