Detect Backup Software Discovery in Microsoft Sentinel
Adversaries may attempt to get a listing of backup software or configurations installed on a system. This discovery technique is commonly performed as pre-ransomware reconnaissance to identify backup solutions (Veeam, Acronis, Backup Exec, Commvault, Windows Server Backup) so attackers can disable, destroy, or encrypt them before deploying ransomware payloads. Methods include registry queries (reg query), process enumeration (tasklist, wmic), service enumeration (sc query, net start), directory listings, and PowerShell-based enumeration scripts such as the Get-DataInfo.ps1 script used by Wizard Spider (FIN12).
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1518 Software Discovery
- Sub-technique
- T1518.002 Backup Software Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1518/002/
KQL Detection Query
let BackupSoftwareNames = dynamic([
"veeam", "acronis", "backup exec", "commvault", "simpana", "arcserve",
"paragon", "cobian", "backupassist", "bacula", "carbonite",
"backblaze", "crashplan", "barracuda", "datto", "zerto",
"veritas", "symantec backup", "wbadmin", "ntbackup"
]);
let BackupRegistryPaths = dynamic([
"veeam", "acronis", "backup exec", "commvault", "arcserve", "paragon",
"cobian backup", "backupassist", "windowsbackup"
]);
let BackupServiceNames = dynamic([
"veeambackup", "veeamtransport", "veeamagent", "acronisagent", "acrsch2svc",
"backupexecagent", "backupexecdevice", "backupexecjobengine", "backupexecmgmt",
"cbvscsvc", "gxclmgrs", "gxcvd", "wbengine", "sdrsvc"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
(FileName =~ "reg.exe" and ProcessCommandLine has_any ("query", "QUERY") and ProcessCommandLine has_any (BackupRegistryPaths))
or (FileName =~ "sc.exe" and ProcessCommandLine has_any ("query", "QUERY") and ProcessCommandLine has_any (BackupServiceNames))
or (FileName =~ "net.exe" and ProcessCommandLine has "start" and ProcessCommandLine has_any (BackupServiceNames))
or (FileName =~ "net1.exe" and ProcessCommandLine has "start" and ProcessCommandLine has_any (BackupServiceNames))
or (FileName =~ "wmic.exe" and ProcessCommandLine has_any ("product", "process", "service") and ProcessCommandLine has_any (BackupSoftwareNames))
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any (
"Get-DataInfo", "Get-Service", "Get-ItemProperty", "Get-WmiObject", "Get-CimInstance"
) and ProcessCommandLine has_any (BackupSoftwareNames))
or (FileName =~ "tasklist.exe" and ProcessCommandLine has_any (BackupSoftwareNames))
or (FileName =~ "cmd.exe" and ProcessCommandLine has_any ("dir", "DIR") and ProcessCommandLine has_any (BackupSoftwareNames))
)
| extend DiscoveryMethod = case(
FileName =~ "reg.exe", "Registry Query",
FileName =~ "sc.exe", "Service Control Query",
FileName in~ ("net.exe", "net1.exe"), "Net Service Enumeration",
FileName =~ "wmic.exe", "WMI Query",
FileName in~ ("powershell.exe", "pwsh.exe"), "PowerShell Enumeration",
FileName =~ "tasklist.exe", "Process List Enumeration",
FileName =~ "cmd.exe", "Directory Listing",
"Other"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DiscoveryMethod
| sort by Timestamp descDetects backup software discovery activity using multiple enumeration methods including registry queries targeting backup software keys (Veeam, Acronis, Backup Exec, Commvault), service control queries, WMI product/process enumeration, PowerShell-based discovery scripts (such as Get-DataInfo.ps1 used by Wizard Spider/FIN12), tasklist enumeration, and directory listing commands. This technique is a documented ransomware precursor indicator observed in Play, Hive, Conti, and FIN12 campaigns.
Data Sources
Required Tables
False Positives & Tuning
- Backup administrators running legitimate inventory or health-check scripts to verify backup agent status across endpoints
- IT asset management tools (Lansweeper, PDQ Inventory, Snipe-IT) that enumerate installed software and services during scheduled discovery scans
- Monitoring agents (Zabbix, PRTG, SolarWinds) checking backup service health and process status as part of regular infrastructure monitoring
- Backup software itself performing self-checks or compatibility validation during installation, upgrade, or scheduled maintenance windows
Other platforms for T1518.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Registry Query for Veeam and Acronis Backup Software
Expected signal: Sysmon Event ID 1: Four Process Create events with Image=reg.exe, CommandLine containing 'query' and 'Veeam' or 'Acronis'. Security Event ID 4688 (if command line auditing is enabled) with same details. If registry Object Access auditing is enabled, Event ID 4663 fires for each registry key read attempt.
- Test 2PowerShell WMI Backup Software Enumeration via Win32_Product
Expected signal: Sysmon Event ID 1: Two Process Create events with Image=powershell.exe, CommandLine containing 'Get-WmiObject' and 'Win32_Product' with backup-related filter terms, and 'Get-Service' with backup terms. PowerShell ScriptBlock Log Event ID 4104 with full script content. WMI activity logged in Microsoft-Windows-WMI-Activity/Operational.
- Test 3Service Control Enumeration of Backup Services
Expected signal: Sysmon Event ID 1: Six Process Create events with Image=sc.exe and CommandLine containing 'query' followed by the backup service name. Security Event ID 4688 for each sc.exe execution if command line auditing is enabled. Note: service status queries do not require elevated privileges and will run as standard user.
- Test 4Tasklist and Net Start Backup Process Discovery
Expected signal: Sysmon Event ID 1: Process Create events for tasklist.exe and net.exe (or net1.exe), with findstr.exe child processes containing backup-related search terms in command line. Security Event ID 4688 for each process if command line auditing enabled.
References (5)
- https://attack.mitre.org/techniques/T1518/002/
- https://www.mandiant.com/resources/blog/fin12-ransomware-intrusion-actor-targeting-healthcare
- https://www.security.com/threat-intelligence/play-ransomware-volume-shadow-copy
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1518.002/T1518.002.md
Unlock Pro Content
Get the full detection package for T1518.002 including response playbook, investigation guide, and atomic red team tests.