microsoft_windows_backup | Detection.FYI

Backup Catalog Deleted

Apr 28, 2026 · attack.stealth attack.t1070.004 ·
Share on:

Detects backup catalog deletions

Read More

Recent Posts

.RDP File Created By Uncommon Application
A Rule Has Been Deleted From The Windows Firewall Exception List
Abuse of Service Permissions to Hide Services Via Set-Service
Abuse of Service Permissions to Hide Services Via Set-Service - PS
Abused Debug Privilege by Arbitrary Parent Processes
Abusing Print Executable
Account Created And Deleted Within A Close Time Frame
Account Disabled or Blocked for Sign in Attempts

Language

SIGMA 4083 ELASTIC 1813 MQL 991

Tags

RESOURCES-INVESTIGATION-GUIDE 1737 USE-CASE-THREAT-DETECTION 1371 ATTACK.EXECUTION 1096 DOMAIN-ENDPOINT 1064 ATTACK.STEALTH 1039 DATA-SOURCE-ELASTIC-DEFEND 875 ATTACK.PERSISTENCE 867 ATTACK.PRIVILEGE-ESCALATION 740 OS-WINDOWS 546 OS-LINUX 496 DATA-SOURCE-ELASTIC-ENDGAME 472 DETECTION.EMERGING-THREATS 455 TACTIC-DEFENSE-EVASION 432 DATA-SOURCE-SENTINELONE 423