Backup product named in a service or process discovery command

Siemphony@siemphonymediumT1518.002unverified

MITRE's analytic pairs a discovery command — tasklist, sc query, reg query, dir under cmd, or the PowerShell and WMI equivalents — with the name of a backup product, and that pairing is exactly what this rule requires: the executable must be one of those enumeration tools and the command line must name a backup vendor. Both halves are needed because either alone is worthless, since sc query runs constantly and a vendor name appears in unrelated paths all day. Veeam, Acronis and CrashPlan come from MITRE's own text; the rest of the vendor list is the author's, and it is the concrete population of MITRE's KnownBackupVendors knob rather than anything MITRE supplies. findstr and cmd are in the tool list so that the piped form is not missed — in tasklist piped to findstr the vendor name is on the findstr command line, not on tasklist's. Dropbox, which MITRE also names, is left out because a sync client appears in ordinary file paths too often to carry signal. This category is fed here by Security EventID 4688, which requires Audit Process Creation and, for CommandLine to be populated at all, the separate policy that includes the command line in the event; neither is enabled by default, and without the second one this rule matches nothing. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0088, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\tasklist.exe" or FolderPath endswith "\\sc.exe" or FolderPath endswith "\\reg.exe" or FolderPath endswith "\\wmic.exe" or FolderPath endswith "\\net.exe" or FolderPath endswith "\\findstr.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "veeam" or ProcessCommandLine contains "acronis" or ProcessCommandLine contains "crashplan" or ProcessCommandLine contains "backupexec" or ProcessCommandLine contains "netbackup" or ProcessCommandLine contains "commvault" or ProcessCommandLine contains "arcserve" or ProcessCommandLine contains "macrium" or ProcessCommandLine contains "shadowprotect" or ProcessCommandLine contains "rubrik" or ProcessCommandLine contains "cohesity" or ProcessCommandLine contains "datto"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\tasklist.exe" OR Image="*\\sc.exe" OR Image="*\\reg.exe" OR Image="*\\wmic.exe" OR Image="*\\net.exe" OR Image="*\\findstr.exe" OR Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*veeam*" OR CommandLine="*acronis*" OR CommandLine="*crashplan*" OR CommandLine="*backupexec*" OR CommandLine="*netbackup*" OR CommandLine="*commvault*" OR CommandLine="*arcserve*" OR CommandLine="*macrium*" OR CommandLine="*shadowprotect*" OR CommandLine="*rubrik*" OR CommandLine="*cohesity*" OR CommandLine="*datto*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\tasklist.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sc.exe" OR TO_LOWER(process.executable) LIKE "*\\\\reg.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wmic.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\findstr.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*veeam*" OR TO_LOWER(process.command_line) LIKE "*acronis*" OR TO_LOWER(process.command_line) LIKE "*crashplan*" OR TO_LOWER(process.command_line) LIKE "*backupexec*" OR TO_LOWER(process.command_line) LIKE "*netbackup*" OR TO_LOWER(process.command_line) LIKE "*commvault*" OR TO_LOWER(process.command_line) LIKE "*arcserve*" OR TO_LOWER(process.command_line) LIKE "*macrium*" OR TO_LOWER(process.command_line) LIKE "*shadowprotect*" OR TO_LOWER(process.command_line) LIKE "*rubrik*" OR TO_LOWER(process.command_line) LIKE "*cohesity*" OR TO_LOWER(process.command_line) LIKE "*datto*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\tasklist\.exe$|\\sc\.exe$|\\reg\.exe$|\\wmic\.exe$|\\net\.exe$|\\findstr\.exe$|\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(veeam|acronis|crashplan|backupexec|netbackup|commvault|arcserve|macrium|shadowprotect|rubrik|cohesity|datto)</field>    <description>Backup product named in a service or process discovery command</description>    <mitre>      <id>T1518.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 281ecc1f-c446-479a-84c2-e0e4a0b0c2c5

ATT&CKT1518.002

T1518.002Backup Software Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

One process-creation event where the executable is an enumeration tool and the command line names a backup vendor. Both halves are required. AN0240 describes "execution of commands like tasklist, sc query, reg query, or PowerShell WMI/Registry queries targeting known backup products," with parent-child lineage and enumeration of services, directories or registry paths. This rule takes the process-creation leg. The registry (registry_set, registry_rename) and file-creation legs of the analytic are unused, and the lineage clause — MITRE's SuspiciousParentProcesses knob — is not implemented, though ParentImage exists on this category and could carry it.

02 · Telemetry you need

category: process_creation / product: windows, verbatim from AN0240's Security EventID 4688 entry.
That means two audit policies, neither on by default and neither in the CIS baseline: Audit Process Creation, and the separate Include command line in process creation events. Without the second, CommandLine is empty and the entire selection_product block matches nothing.
There is also a translator trap. The rule is written in the Sigma process_creation taxonomy, so it uses Image, and the Sentinel render maps that correctly to NewProcessName. The Splunk and Elastic renders emit a literal `Image`, which does not exist in a raw 4688 index — copy those and you get zero rows. On a 4688 feed, Image is NewProcessName; check your backend's field mapping first.

03 · How the logic works

endswith with a leading backslash anchors on a filename boundary — it survives path variation and refuses a decoy named mytasklist.exe. findstr.exe and cmd.exe are in the tool list on purpose: in tasklist | findstr veeam the vendor string is on findstr's command line, not tasklist's. Attribution matters here and the rule gets it right. Veeam, Acronis and CrashPlan are MITRE's own examples. The other nine are the author's population of MITRE's KnownBackupVendors knob. MITRE also names Dropbox; the author dropped it because a sync client turns up in ordinary paths too often. Now the reviewer's central finding, which is a good lesson in reading your own condition. Requiring the vendor name means the commands MITRE's analytic leads with never fire. Trace it: an operator runs tasklist /svc, sc query type= service state= all, or wmic product get name and reads the output. No vendor string is ever on a command line. No match. This rule only catches an adversary who already knows which vendor to grep for — the narrower, later half of the behaviour. Two more from the review: - `\net.exe` is dead for this purpose. net start takes no filter argument, so a vendor name only reaches net.exe via net stop "Veeam Backup Service" — that is T1489 Service Stop, not discovery. - `\wmic.exe` is decaying. It is deprecated and removed by default in Windows 11 24H2 and Server 2025. - \find.exe, the other half of the pipe idiom the description explains, is absent while \findstr.exe is present.

04 · Common false positives

The backup product's own automation. Veeam Agent launches `cmd.exe /c
`datto` is not a backup-only string. Datto RMM is a general-purpose MSP
Monitoring, asset-inventory and patch tooling enumerating services on a cycle.
Backup admins and vendor support checking agent state — the command is

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0088, never run against a log line. Both field names are real and all four backends render, but that is a statement about syntax, not about whether anything would ever match.
tier_2: confirm CommandLine is populated in your 4688 feed at all, then run read-only across one full backup cycle and rank hits by Image path. Expect the backup agents themselves at the top; every one becomes an exclusion.
tier_3: is MITRE's actual shape — a discovery command correlated with what the same user does next — which needs sequencing Sigma cannot express.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude `Image` paths under the backup vendors' own install directories
Drop `datto`, or split it into its own lower-level rule; it changes the
Add the unfiltered form as a separate, lower rule — bare tasklist,
Implement MITRE's `UserContextScope` knob: 4688 carries SubjectUserName,
MITRE's `SuspiciousParentProcesses` knob maps to ParentProcessName — an
Drop \net.exe, add \find.exe, and expect \wmic.exe to stop mattering.

Declared by the author

The backup product running its own automation. Agents and job schedulers launch cmd.exe and powershell.exe from a directory carrying the vendor name on every job, which satisfies both halves of this rule without any discovery taking place, and it recurs on the backup schedule.
Monitoring, asset-inventory and patch-management tooling that enumerates services and installed software with sc query, wmic or reg query on a cycle, matching one vendor name per host per run.
Backup administrators and vendor support engineers checking agent and service state interactively. The command is identical to the adversary's, so nothing in the event separates them — MITRE's UserContextScope knob is the intended discriminator, scoping to interactive or low-privilege users rather than the service accounts these jobs run under.
The vendor names are unanchored substrings tested against the whole command line, so any argument containing one — an installation path, a log directory, a share name — matches even when the command has nothing to do with enumeration.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1518.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/281ecc1f-c446-479a-84c2-e0e4a0b0c2c5

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Backup product named in a service or process discovery command

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it