Detect Malicious Usage of Recovery Tools to Delete Backup Files

Back


Id	259de2c1-c546-4c6d-a17c-df639722f4d7
Rulename	Detect Malicious Usage of Recovery Tools to Delete Backup Files
Description	This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files. https://attack.mitre.org/techniques/T1490/
Severity	High
Tactics	Impact
Techniques	T1490
Required data connectors	CiscoSecureEndpoint CrowdStrikeFalconEndpointProtection MicrosoftThreatProtection SentinelOne TrendMicroApexOne TrendMicroApexOneAma VMwareCarbonBlack
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Malware Protection Essentials/Analytic Rules/BackupDeletionDetected.yaml
Version	1.0.0
Arm template	259de2c1-c546-4c6d-a17c-df639722f4d7.json

KQL

_ASim_ProcessEvent
| where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe')
| where CommandLine has_all ('delete', 'shadow')
| union isfuzzy=True 
    (_ASim_ProcessEvent
    | where TargetProcessFilename =~ 'bcedit.exe'
    | where CommandLine has_all ('/set', 'recoveryenabled no')
    )
| project
    TimeGenerated,
    DvcHostname,
    DvcIpAddr,
    DvcDomain,
    TargetUsername,
    TargetUsernameType,
    TargetProcessName,
    TargetProcessId,
    CommandLine
| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[1]), TargetUsername)
| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[0]), TargetUsername)
| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)
| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')

YAML

queryFrequency: 1h
relevantTechniques:
- T1490
tactics:
- Impact
id: 259de2c1-c546-4c6d-a17c-df639722f4d7
triggerOperator: gt
triggerThreshold: 0
status: Available
query: |
  _ASim_ProcessEvent
  | where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe')
  | where CommandLine has_all ('delete', 'shadow')
  | union isfuzzy=True 
      (_ASim_ProcessEvent
      | where TargetProcessFilename =~ 'bcedit.exe'
      | where CommandLine has_all ('/set', 'recoveryenabled no')
      )
  | project
      TimeGenerated,
      DvcHostname,
      DvcIpAddr,
      DvcDomain,
      TargetUsername,
      TargetUsernameType,
      TargetProcessName,
      TargetProcessId,
      CommandLine
  | extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[1]), TargetUsername)
  | extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[0]), TargetUsername)
  | extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)
  | extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')  
severity: High
eventGroupingSettings:
  aggregationKind: AlertPerResult
kind: Scheduled
requiredDataConnectors:
- connectorId: CrowdStrikeFalconEndpointProtection
  dataTypes:
  - CommonSecurityLog
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - SecurityAlert
- connectorId: SentinelOne
  dataTypes:
  - SentinelOne_CL
- connectorId: VMwareCarbonBlack
  dataTypes:
  - CarbonBlackEvents_CL
- connectorId: CiscoSecureEndpoint
  dataTypes:
  - CiscoSecureEndpoint_CL
- connectorId: TrendMicroApexOne
  dataTypes:
  - TMApexOneEvent
- connectorId: TrendMicroApexOneAma
  dataTypes:
  - TMApexOneEvent
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DvcHostname
  - identifier: DnsDomain
    columnName: DvcDomain
  - identifier: NTDomain
    columnName: NTDomain
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DvcIpAddr
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: Username
  - identifier: UPNSuffix
    columnName: UPNSuffix
  - identifier: NTDomain
    columnName: NTDomain
- entityType: Process
  fieldMappings:
  - identifier: ProcessId
    columnName: TargetProcessId
  - identifier: CommandLine
    columnName: CommandLine
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Malware Protection Essentials/Analytic Rules/BackupDeletionDetected.yaml
name: Detect Malicious Usage of Recovery Tools to Delete Backup Files
description: |
  This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files.
  https://attack.mitre.org/techniques/T1490/  
alertDetailsOverride:
  alertDescriptionFormat: 'A system tool {{TargetProcessName}} ProcessId: ({{TargetProcessId}}) with {{CommandLine}} used to delete backup files.'
  alertDisplayNameFormat: Tool {{TargetProcessName}} used to delete backup files on {{DvcHostname}} by {{TargetUsername}}
tags:
- Schema: _ASim_ProcessEvent
  SchemaVersion: 0.1.4
queryPeriod: 1h

ARM