Backup Sabotage Tactics: Countering Pre-Encryption Attacks on Recovery Infrastructure

---
title: Potential Backup Service Stop via SC.EXE
id: 4f8b3a2d-1c6e-4b7f-9a0d-3e5f6a7b8c9d
status: experimental
description: Detects attempts to stop backup-related services using sc.exe. Attackers often stop services to prevent backups or allow file deletion.
references:
  - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2024/10/28
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains: ' stop '
  selection_backup_services:
    CommandLine|contains:
      - 'VeeamBackupSvc'
      - 'AcronisManagedMachineService'
      - 'MMS'
      - 'CBT'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative maintenance
level: high
---
title: Deletion of Volume Shadow Copies
id: 5e9c4b3e-2d7f-5c8g-0b1e-4f6a7b8c9d0e
status: experimental
description: Detects commands used to delete Volume Shadow Copies (VSS), a common precursor to ransomware to prevent file recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2024/10/28
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowstorage delete'
      - 'Remove-WmiObject -Class Win32_ShadowCopy'
  condition: selection
falsepositives:
  - System administration tasks (rare in production environments)
level: critical
---
title: Acronis CLI Backup Deletion or Stop
id: 6a0d5c4f-3e8g-6h9i-1c2d-5e7f8a9b0c1d
status: experimental
description: Detects usage of Acronis CLI tools (acrocmd) with arguments indicating backup stop, deletion, or unregistration.
references:
  - https://www.acronis.com
datauthor: Security Arsenal
date: 2024/10/28
tags:
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\acrocmd.exe'
      - '\ManagedMachineService.exe'
  selection_params:
    CommandLine|contains:
      - ' --delete '
      - ' --unregister '
      - ' --stop '
  condition: all of selection_*
falsepositives:
  - Backup administrator operations
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for backup service stops and VSS deletion attempts
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (ProcessCommandLine contains " stop " and FileName =~ "sc.exe") or
       (ProcessCommandLine contains "delete shadows" and FileName in~ ("vssadmin.exe", "wmic.exe")) or
       (FileName in~ ("acrocmd.exe", "veeam.cmd") and (ProcessCommandLine contains "delete" or ProcessCommandLine contains "stop"))
| extend Evidence = Pack(ProcessCommandLine, AccountName, DeviceName)
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName, Evidence


**Velociraptor VQL**

-- Hunt for suspicious process execution related to backup sabotage
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "sc.exe" AND CommandLine =~ "\s+stop\s+(Veeam|Acronis|MMS)"
   OR Name =~ "vssadmin.exe" AND CommandLine =~ "delete"
   OR Name =~ "wmic.exe" AND CommandLine =~ "shadow"
   OR Name =~ "powershell.exe" AND CommandLine =~ "Remove-WmiObject.*ShadowCopy"


**Remediation Script (PowerShell)**

<#
.SYNOPSIS
    Backup Integrity Check & Verification Script
.DESCRIPTION
    Checks status of critical backup services and verifies connectivity to backup repositories.
    Run this as a scheduled task or during incident response triage.
#>

$CriticalServices = @(
    "VeeamBackupSvc",
    "AcronisManagedMachineService",
    "VeeamCatalogSvc",
    "MMS"
)

Write-Host "[+] Initiating Backup Infrastructure Health Check..." -ForegroundColor Cyan

$FailedServices = @()

foreach ($ServiceName in $CriticalServices) {
    $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
    if ($Service) {
        if ($Service.Status -ne "Running") {
            Write-Host "[!] CRITICAL: Service $ServiceName is currently stopped." -ForegroundColor Red
            $FailedServices += $ServiceName
        } else {
            Write-Host "[+] OK: Service $ServiceName is running." -ForegroundColor Green
        }
    } else {
        Write-Host "[-] INFO: Service $ServiceName not found on this host." -ForegroundColor Gray
    }
}

if ($FailedServices.Count -gt 0) {
    Write-Host "[!!!] ALERT: Backup services have been stopped. Investigate immediately." -ForegroundColor Red
    # Optional: Auto-restart could be enabled here, but manual review is recommended during IR.
    # Start-Service -Name $FailedServices -ErrorAction SilentlyContinue
} else {
    Write-Host "[+] No backup service anomalies detected." -ForegroundColor Green
}

# Check for recent VSS Deletion Events (Event ID 7036 for service stop, or look for process logs)
Write-Host "[+] Checking Event Logs for VSS Admin interaction..."
$VssEvents = Get-WinEvent -LogName "Security" -FilterXPath "*[System[(EventID=4688)]] and *[EventData[Data[@Name='NewProcessName']='C:\Windows\System32\vssadmin.exe']]" -MaxEvents 5 -ErrorAction SilentlyContinue
if ($VssEvents) {
    Write-Host "[!] WARNING: vssadmin.exe execution detected recently." -ForegroundColor Yellow
    $VssEvents | Select-Object TimeCreated, Message | Format-List
}