cscli scenarios install sigmahq/proc_creation_win_wbadmin_delete_all_backups1type: trigger2name: sigmahq/proc_creation_win_wbadmin_delete_all_backups3description: |4 Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\wbadmin.exe' || evt.Parsed.OriginalFileName == 'WBADMIN.EXE') && evt.Parsed.CommandLine contains 'delete' && evt.Parsed.CommandLine contains 'backup' && evt.Parsed.CommandLine contains 'keepVersions:0')7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t14901516 label: "All Backups Deleted Via Wbadmin.EXE"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324