Backup
في هذه الصفحة
Backup answers: can the host be recovered, and did someone take that away? Removing the ways back is a classic step before ransomware.
At a glance
Question | Whether the host can be recovered, and whether someone took that away. |
Reads | Each volume's shadow copies and their storage, System Restore, the Windows Recovery Environment, boot recovery, File History and Windows Backup, the services they run on, and the records of copies lost or a backup catalog deleted. |
Rule prefix |
|
What it reads
Source | Evidence |
|---|---|
Shadow copies and their storage (WMI), System Restore's policy, ReAgent.xml, the boot configuration's default entry, File History's policy |
|
The Volume Shadow Copy service and the services recovery runs on |
|
Windows Backup's log |
|
System log, volsnap 25 and 36 |
|
Signals it raises
7 rules: 3 high, 4 medium. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| high | Windows' automatic boot recovery is turned off |
|
|
| high | Windows Backup's catalog was deleted |
|
|
| high | The Volume Shadow Copy service is disabled |
|
|
| medium | System Restore is turned off by policy |
|
|
| medium | A backup service is disabled |
|
|
| medium | Windows lost every shadow copy of a volume |
|
|
| medium | A volume's shadow copy storage is limited to almost nothing |
|
|
How to read it
The recovery table: each mechanism, its state in words, what decided it (a policy, the boot configuration), its storage and its point in time.
"not read: ..." is never "off". A mechanism Signal could not read says so.
Pair it with Executions: commands that delete copies or shrink their storage are Executions' signals; the result is Backup's.
What it can't see
Next
Directory: what the domain pushed to this host.