Skip to content

Commit 1236b94

Browse files
authored
Update rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml
1 parent b87ba17 commit 1236b94

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ license = "Elastic License v2"
2727
name = "Backup Deletion with Wbadmin"
2828
note = """## Triage and analysis
2929
30-
### Investigating Deleting Backup Catalogs with Wbadmin
30+
### Investigating Backup Deletion with Wbadmin
3131
3232
Windows Server Backup stores the details about your backups (what volumes are backed up and where the backups are located) in a file called a backup catalog, which ransomware victims can use to recover corrupted backup files. Deleting these files is a common step in threat actor playbooks.
3333

0 commit comments

Comments
 (0)