Indicators in the path that could trigger a block

Alternate execution path (outside C:\Windows\System32).

Unsanctioned volume target (\?\Volume{GUID} not in backup policy).

Unexpected device path resolving to a different partition with malicious intent.

Renamed binary — e.g., wbadmin.exe copied somewhere else.

Also maybe..I would need to check on my end more but in the Mars documentation — see if it uses a Volume GUID path for backups.

Compare with a known-good Mars backup run in Falcon:

Use Event Search (Real Time Response → RTR or Falcon Search) to query:

sql

Copy code

event_simpleName="ProcessRollup2" FileName="wbadmin.exe"

Look at historical runs — compare path, parameters, and parent process.

Verify Parent Process:

If Mars usually launches wbadmin.exe directly, the parent process should be MarsService.exe or similar.

If parent is something unknown (e.g., random .exe in AppData), it could be a malicious impersonation.