Process
wbadmin.exe
wbadmin.exe is the Windows Backup command-line tool, used to create and recover backups of volumes, files, and system state. Administrators use it for backup and restore. Attackers use it to delete those backups before ransomware encrypts, and to recover the Active Directory database out of a system-state backup.
File identity
Not observed.
Not observed.
Not observed.
Not observed.
Execution context
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Ancestry
Not observed.
Not observed.
Not observed.
Not observed.
Behavior
Not observed.
Not observed.
Not observed.
Not observed.
wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quietDump · Snapshoting of Active Directory NTDS.dit databasewbadmin start recovery -version:<VERSIONIDENTIFIER> -recoverytarget:{PATH_ABSOLUTE:folder} -itemtype:file -items:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -notRestoreAcl -quietDump · Dumping of Active Directory NTDS.dit database
Indicators
Not observed.
Analysis
wbadmin.exe drives Windows Server Backup (and the backup engine on client editions). It can back up and restore volumes, individual files, and the system state (which on a domain controller includes the Active Directory database), and it manages the backup catalog that tracks them. It requires administrative rights and lives at C:\Windows\System32\wbadmin.exe.
Legitimately, wbadmin is run by administrators and scheduled backup jobs. The operation it performs, backing up, restoring, or deleting, is what gives an instance meaning.
wbadmin.exe is a recovery-inhibition tool for ransomware (T1490). wbadmin delete catalog -quiet and wbadmin delete systemstatebackup destroy the backups a victim would use to restore, and they often appear next to shadow-copy deletion (vssadmin) and boot-recovery tampering (bcdedit) in the moments before encryption.
On a domain controller it is also a credential-access route (T1003.003). Because the system-state backup contains ntds.dit, an attacker can use wbadmin start recovery to restore the directory database from a backup and then read the domain password hashes out of it. A delete-backup command from a script host, or a system-state recovery with no planned restore, is what separates abuse from administration.
- Image path other than
C:\Windows\System32\wbadmin.exehigh delete catalogordelete systemstatebackup(destroying backups)highstart recoveryof system state orntds.ditoutside a planned restorehigh- Parent is
cmd.exe,powershell.exe, or an unfamiliar processhigh - Run alongside
vssadmin,bcdedit, orwmic shadowcopy deletehigh
Telemetry
Not observed.
Not observed.