Backup product named in a service or process discovery command

1title: Backup product named in a service or process discovery command2id: 281ecc1f-c446-479a-84c2-e0e4a0b0c2c53status: experimental4description: |5  MITRE's analytic pairs a discovery command — tasklist, sc query, reg query, dir6  under cmd, or the PowerShell and WMI equivalents — with the name of a backup7  product, and that pairing is exactly what this rule requires: the executable8  must be one of those enumeration tools and the command line must name a backup9  vendor. Both halves are needed because either alone is worthless, since sc query10  runs constantly and a vendor name appears in unrelated paths all day. Veeam,11  Acronis and CrashPlan come from MITRE's own text; the rest of the vendor list is12  the author's, and it is the concrete population of MITRE's KnownBackupVendors13  knob rather than anything MITRE supplies. findstr and cmd are in the tool list14  so that the piped form is not missed — in tasklist piped to findstr the vendor15  name is on the findstr command line, not on tasklist's. Dropbox, which MITRE16  also names, is left out because a sync client appears in ordinary file paths17  too often to carry signal. This category is fed here by Security EventID 4688,18  which requires Audit Process Creation and, for CommandLine to be populated at19  all, the separate policy that includes the command line in the event; neither20  is enabled by default, and without the second one this rule matches nothing.21  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0088, not hand-written and not tested by its author. Any lab result is on this rule's own page.22references:23  - https://attack.mitre.org/techniques/T1518/00224  - https://attack.mitre.org/detectionstrategies/DET008825author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)26date: 2026-08-1627tags:28  - attack.discovery29  - attack.t1518.00230logsource:31  category: process_creation32  product: windows33detection:34  selection_tool:35    Image|endswith:36      - '\tasklist.exe'37      - '\sc.exe'38      - '\reg.exe'39      - '\wmic.exe'40      - '\net.exe'41      - '\findstr.exe'42      - '\cmd.exe'43      - '\powershell.exe'44      - '\pwsh.exe'45  selection_product:46    CommandLine|contains:47      - 'veeam'48      - 'acronis'49      - 'crashplan'50      - 'backupexec'51      - 'netbackup'52      - 'commvault'53      - 'arcserve'54      - 'macrium'55      - 'shadowprotect'56      - 'rubrik'57      - 'cohesity'58      - 'datto'59  condition: selection_tool and selection_product60falsepositives:61  - "The backup product running its own automation. Agents and job schedulers launch cmd.exe and powershell.exe from a directory carrying the vendor name on every job, which satisfies both halves of this rule without any discovery taking place, and it recurs on the backup schedule."62  - "Monitoring, asset-inventory and patch-management tooling that enumerates services and installed software with sc query, wmic or reg query on a cycle, matching one vendor name per host per run."63  - "Backup administrators and vendor support engineers checking agent and service state interactively. The command is identical to the adversary's, so nothing in the event separates them — MITRE's UserContextScope knob is the intended discriminator, scoping to interactive or low-privilege users rather than the service accounts these jobs run under."64  - "The vendor names are unanchored substrings tested against the whole command line, so any argument containing one — an installation path, a log directory, a share name — matches even when the command has nothing to do with enumeration."65level: medium