Sensitive File Dump Via Wbadmin.EXE

 1title: Sensitive File Dump Via Wbadmin.EXE
 2id: 8b93a509-1cb8-42e1-97aa-ee24224cdc15
 3status: experimental
 4description: |
 5    Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
 6    Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.    
 7references:
 8    - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
 9    - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
10    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
11    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
12author: Nasreddine Bencherchali (Nextron Systems), frack113
13date: 2024-05-10
14tags:
15    - attack.credential-access
16    - attack.t1003.003
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection_img:
22        - Image|endswith: '\wbadmin.exe'
23        - OriginalFileName: 'WBADMIN.EXE'
24    selection_backup:
25        CommandLine|contains:
26            - 'start'
27            - 'backup'
28    selection_path:
29        CommandLine|contains:
30            - '\config\SAM'
31            - '\config\SECURITY'
32            - '\config\SYSTEM'
33            - '\Windows\NTDS\NTDS.dit'
34    condition: all of selection_*
35falsepositives:
36    - Legitimate backup operation by authorized administrators. Matches must be investigated and allowed on a case by case basis.
37level: high

References

• LOLBAS/yml/OSBinaries/Wbadmin.yml at 2cc01b01132b5c304027a658c698ae09dd6a92bf · LOLBAS-Project/LOLBAS

  

  Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts) - LOLBAS-Project/LOLBAS

  
  Read More

• Wbadmin on LOLBAS

  

  wbadmin.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases.

  
  Read More

• wbadmin start recovery

  

  Reference article for the wbadmin start recovery command, which runs a recovery operation based on the parameters that you specify.

  
  Read More

• wbadmin start backup

  

  Reference article for the wbadmin start backup command, which creates a backup using specified parameters.

  
  Read More

Related rules

• Active Directory Database Snapshot Via ADExplorer
• Copying Sensitive Files with Credential Data
• Create Volume Shadow Copy with Powershell
• Cred Dump Tools Dropped Files
• Esentutl Gather Credentials