Skip to content
Threat Feed
Subscribe

Tag

Backup Deletion

3 briefs RSS
medium advisory

Third-party Backup Files Deleted via Unexpected Process

This detection identifies the deletion of backup files by processes outside of the backup suite, specifically targeting Veritas and Veeam backups, which may indicate an attempt to prevent recovery from ransomware.

Elastic Defend +5 impact backup deletion ransomware
2r 2t
medium advisory

Windows Backup Deletion via Wbadmin

Adversaries may delete Windows backup catalogs and system state backups using wbadmin.exe to inhibit system recovery, often as part of ransomware or other destructive attacks.

Microsoft Defender XDR +3 impact backup-deletion windows
2r 2t
medium advisory

Wbadmin Backup Catalog Deletion

Adversaries may delete Windows backup catalogs using wbadmin.exe to inhibit system recovery, often as part of ransomware or other destructive attacks.

impact backup-deletion ransomware windows
2r 2t