Sensitive File Dump Via Wbadmin.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Source: github.com/SigmaHQ/sigma

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Known false positives

Legitimate backup operation by authorized administrators. Matches must be investigated and allowed on a case by case basis.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.003` OS Credential Dumping: NTDS

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Sensitive File Dump Via Wbadmin.EXE
id: 8b93a509-1cb8-42e1-97aa-ee24224cdc15
status: test
description: |
    Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
    Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
references:
    - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
    - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
author: Nasreddine Bencherchali (Nextron Systems), frack113
date: 2024-05-10
tags:
    - attack.credential-access
    - attack.t1003.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\wbadmin.exe'
        - OriginalFileName: 'WBADMIN.EXE'
    selection_backup:
        CommandLine|contains:
            - 'start'
            - 'backup'
    selection_path:
        CommandLine|contains:
            - '\config\SAM'
            - '\config\SECURITY'
            - '\config\SYSTEM'
            - '\Windows\NTDS\NTDS.dit'
    condition: all of selection_*
falsepositives:
    - Legitimate backup operation by authorized administrators. Matches must be investigated and allowed on a case by case basis.
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\wbadmin.exe'
    - OriginalFileName: 'WBADMIN.EXE'

Stage 2: `selection_backup`

selection_backup:
    CommandLine|contains:
        - 'start'
        - 'backup'

Stage 3: `selection_path`

selection_path:
    CommandLine|contains:
        - '\config\SAM'
        - '\config\SECURITY'
        - '\config\SYSTEM'
        - '\Windows\NTDS\NTDS.dit'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`\Windows\NTDS\NTDS.dit` corpus 5 (sigma 5) `\config\SAM` corpus 4 (sigma 4) `\config\SECURITY` corpus 4 (sigma 4) `\config\SYSTEM` corpus 3 (sigma 3) `backup` corpus 6 (sigma 5, splunk 1) `start` corpus 13 (sigma 11, splunk 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\wbadmin.exe` corpus 7 (sigma 7)	`field:"Image" kind:ends_with value:"\wbadmin.exe"`
`OriginalFileName`	eq	`WBADMIN.EXE` corpus 19 (elastic 11, sigma 6, splunk 2)	`field:"OriginalFileName" kind:eq value:"WBADMIN.EXE"`