Tag
medium
advisory
Third-party Backup Files Deleted via Unexpected Process
2 rules 2 TTPsThis detection identifies the deletion of backup files by processes outside of the backup suite, specifically targeting Veritas and Veeam backups, which may indicate an attempt to prevent recovery from ransomware.
Elastic Defend +5
impact
backup deletion
ransomware
2r
2t
medium
advisory
Windows Backup Deletion via Wbadmin
2 rules 2 TTPsAdversaries may delete Windows backup catalogs and system state backups using wbadmin.exe to inhibit system recovery, often as part of ransomware or other destructive attacks.
Microsoft Defender XDR +3
impact
backup-deletion
windows
2r
2t