Analytics BIOC High
✕

Wbadmin deleted files in quiet mode

Wbadmin was used to delete files in quiet mode.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Inhibit System Recovery (T1490)
Attacker's goals:

Adversaries may delete the backup catalog to prevent recovery of a corrupted system.

Investigative actions:

Check if the delete action was legitimate and performed by an authorized user.

Test period:
N/A (single event)
Deduplication:
1 Day