Pay2Key Backup Catalog Deletion and Boot Recovery Inhibition via wbadmin/bcdedit

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

This rule detects the use of native Windows utilities to inhibit system recovery capabilities. It monitors for the execution of 'wbadmin.exe' to delete the backup catalog and 'bcdedit.exe' to disable automatic boot recovery or ignore boot failures, which are common tactics used by ransomware and other malware to prevent system restoration after data destruction.