Sensitive File Dump Via Wbadmin.EXE

Title: Sensitive File Dump Via Wbadmin.EXE
Status: test
Description:Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
References:
  -https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
  -https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2024-05-10
modified:None
Tags:

• -'attack.credential-access'
• -'attack.t1003.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\wbadmin.exe' OriginalFileName:'WBADMIN.EXE'   selection_backup:
    CommandLine|contains:
      -'start'
      -'backup'

  selection_path:
    CommandLine|contains:
      -'\config\SAM'
      -'\config\SECURITY'
      -'\config\SYSTEM'
      -'\Windows\NTDS\NTDS.dit'

  condition:all of selection_*
Falsepositives:
  -Legitimate backup operation by authorized administrators. Matches must be investigated and allowed on a case by case basis.
Level: high