File Recovery From Backup Via Wbadmin.EXE

심각도 보통 Sigma 탐지 룰. Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from …

작성자: Nasreddine Bencherchali (Nextron Systems), frack113 · 원본 라이선스: DRL 1.1 · SigmaHQ 원본