↳ GitHub sourceAnalytics ruleHigh

Detect Malicious Usage of Recovery Tools to Delete Backup Files

Description

This analytic rule detects usage of recovery tools vssadmin, wbadmin, wmic and bcedit to delete backup files or change recovery configuration. Adversaries may use these tools to delete shadow copies and backup files to prevent recovery of files. https://attack.mitre.org/techniques/T1490/

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Impact T1490

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CrowdStrikeFalconEndpointProtection MicrosoftThreatProtection SentinelOne VMwareCarbonBlack CiscoSecureEndpoint TrendMicroApexOne TrendMicroApexOneAma

Data types

CommonSecurityLog SecurityAlert SentinelOne_CL CarbonBlackEvents_CL CiscoSecureEndpoint_CL TMApexOneEvent

KQL query

Original query, unchanged.

_ASim_ProcessEvent
| where TargetProcessFilename has_any ('vssadmin.exe', 'wbadmin.exe', 'wmic.exe')
| where CommandLine has_all ('delete', 'shadow')
| union isfuzzy=True 
    (_ASim_ProcessEvent
    | where TargetProcessFilename =~ 'bcedit.exe'
    | where CommandLine has_all ('/set', 'recoveryenabled no')
    )
| project
    TimeGenerated,
    DvcHostname,
    DvcIpAddr,
    DvcDomain,
    TargetUsername,
    TargetUsernameType,
    TargetProcessName,
    TargetProcessId,
    CommandLine
| extend Username = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[1]), TargetUsername)
| extend NTDomain = iff(tostring(TargetUsernameType) == 'Windows', tostring(split(TargetUsername, '\\')[0]), TargetUsername)
| extend Username = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[0]), Username)
| extend UPNSuffix = iff(tostring(TargetUsernameType) == 'UPN', tostring(split(TargetUsername, '@')[1]), '')

Declared entities

HostIPAccountProcess

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Malware Protection Essentials/Analytic Rules/BackupDeletionDetected.yaml ↗
Commit: 9800e51 ↗
Source identifier: 259de2c1-c546-4c6d-a17c-df639722f4d7

Additional source files 2

Solutions/Malware Protection Essentials/Analytic Rules/BackupDeletionDetected.yamlsource ↗Solutions/Malware Protection Essentials/Data/Solution_MalwareProtectionEssentials.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.