Windows Backup Catalog Deletion via WBAdmin
This rule detects the use of the Windows native utility 'wbadmin.exe' to delete the backup catalog. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing the ability to restore data from built-in Windows backup utilities.
Microsoft Sentinel (KQL)
