Cross-source coverage

T1490 / ATT&CK

Inhibit System Recovery

116 rules · 115 families across 9 sources.

2 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.

Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact. Furthermore, adversaries may disable recovery notifications, then corrupt backups.

A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:

  • vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet
  • Windows Management Instrumentation can be used to delete volume shadow copies - wmic shadowcopy delete
  • wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet
  • bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  • REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system
  • diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all

On network devices, adversaries may leverage Disk Wipe to delete backup firmware images and reformat the file system, then System Shutdown/Reboot to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.

On ESXi servers, adversaries may delete or encrypt snapshots of virtual machines to support Data Encrypted for Impact, preventing them from being leveraged as backups (e.g., via vim-cmd vmsvc/snapshot.removeall).

Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services. In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.

Tactics
Impact
Platforms
Containers · ESXi · IaaS · Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SysmonWinEventLog:Microsoft-Windows-BackupWinEventLog:Systemauditd:SYSCALLauditd:CONFIG_CHANGEesxi:hostdnetworkdevice:syslogAWS:CloudTrail

How MITRE says to detect it DET0329

Behavioral Detection for T1490 - Inhibit System Recovery

Windows Analytic 0933

Process chains that use native utilities (vssadmin, wbadmin, diskshadow, bcdedit, REAgentC, wmic) with arguments to delete shadow copies, disable recovery, or remove backup catalogs

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Microsoft-Windows-Backup Windows Backup Catalog deletion or catalog corruption
  • WinEventLog:System Service stopped or RecoveryDisabled set via REAgentC
  • WinEventLog:Sysmon EventCode=13, 14

Linux Analytic 0934

Shell utilities or scripts deleting `/etc/systemd/system/rescue.target`, `/etc/fstab` backups, or `/boot/efi` partitions; chattr used to block snapshot auto-recovery

  • auditd:SYSCALL chattr, rm, shred, dd run on recovery directories or partitions
  • auditd:CONFIG_CHANGE /etc/fstab, /etc/systemd/*

ESXi Analytic 0935

ESXi shell or vim-cmd execution that deletes all VM snapshots using vmsvc/snapshot.removeall or rm on snapshot paths

  • esxi:hostd snapshot.removeall or snapshot file deletion

Network Devices Analytic 0936

Execution of `erase`, `format`, and `reload` in immediate sequence from a privileged AAA session

  • networkdevice:syslog command sequence: erase → format → reload

IaaS Analytic 0937

Cloud API calls disabling snapshot scheduling, backup policies, versioning, followed by DeleteSnapshot/DeleteVolume operations

  • AWS:CloudTrail DeleteSnapshot
  • AWS:CloudTrail DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances

View on attack.mitre.org ↗

SigmaHQ/sigma

27 rules
Detection Severity Format
Potential Dtrack RAT Activity Critical Sigma
Potential Maze Ransomware Activity Critical Sigma
WannaCry Ransomware Activity Critical Sigma
All Backups Deleted Via Wbadmin.EXE High Sigma
Boot Configuration Tampering Via Bcdedit.EXE High Sigma
Copy From VolumeShadowCopy Via Cmd.EXE High Sigma
Delete Volume Shadow Copies Via WMI With PowerShell High Sigma
Deletion of Volume Shadow Copies via WMI with PowerShell High Sigma
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script High Sigma
Registry Disable System Restore High Sigma

+ 17 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

20 rules
Detection Severity Format
AWS Backup Recovery Point Deleted High Elastic TOML
AWS Backup Vault Deleted or Vault Lock Removed High Elastic TOML
Azure Compute Restore Point Collections Deleted High Elastic TOML
Potential Ransomware Note File Dropped via SMB High Elastic TOML
Potential System Tampering via File Modification High Elastic TOML
Suspicious File Renamed via SMB High Elastic TOML
Volume Shadow Copy Deleted or Resized via VssAdmin High Elastic TOML
Volume Shadow Copy Deletion via PowerShell High Elastic TOML
Volume Shadow Copy Deletion via WMIC High Elastic TOML
AWS EC2 EBS Snapshot Access Removed Medium Elastic TOML

+ 10 more from elastic/detection-rules → showing the 10 highest-severity

panther-labs/panther-analysis

18 rules
Detection Severity Format
AWS RDS Automated Backup Deleted Critical Panther Python
AWS RDS Deletion Protection Disabled High Panther Python
Azure Recovery Services Protection Container Deleted High Panther Python
Azure Resource Lock Deleted High Panther Python
Azure Storage Account Deleted High Panther Python
Azure Storage Blob CPK Encryption Detected High Panther Python
Azure Storage Blob Soft Delete Disabled High Panther Python
Azure Storage Blob Upload WITH CPK Encryption Error High Panther Python
Azure Storage Container Soft Delete Disabled High Panther Python
Azure Storage Immutability Policy Deleted High Panther Python

+ 8 more from panther-labs/panther-analysis → showing the 10 highest-severity

splunk/security_content

17 rules
Detection Severity Format
ASL AWS Disable Bucket Versioning Undefined SPL
AWS Disable Bucket Versioning Undefined SPL
Bcdedit Command Back To Normal Mode Boot Undefined SPL
BCDEdit Failure Recovery Modification Undefined SPL
Change To Safe Mode With Network Config Undefined SPL
Delete ShadowCopy With PowerShell Undefined SPL
Deleting Shadow Copies Undefined SPL
Disabling SystemRestore In Registry Undefined SPL
Prevent Automatic Repair Mode using Bcdedit Undefined SPL
Resize ShadowStorage volume Undefined SPL

+ 7 more from splunk/security_content → showing the 10 highest-severity

elastic/protections-artifacts

16 rules
Detection Severity Format
BCDEdit Safe Mode Command Execution Undefined Elastic TOML
Inhibit System Recovery Followed by a Suspicious File Rename Undefined Elastic TOML
Inhibit System Recovery via Microsoft Office Process Undefined Elastic TOML
Inhibit System Recovery via Obfuscated Commands Undefined Elastic TOML
Inhibit System Recovery via Renamed Utilities Undefined Elastic TOML
Inhibit System Recovery via Signed Binary Proxy Undefined Elastic TOML
Inhibit System Recovery via Stopping Backup Services Undefined Elastic TOML
Inhibit System Recovery via Untrusted Parent Process Undefined Elastic TOML
Inhibit System Recovery via Windows Command Shell Undefined Elastic TOML
Shadow Copy Deletion via Windows Management Instrumentation Undefined Elastic TOML

+ 6 more from elastic/protections-artifacts → showing the 10 highest-severity

socfortress/Wazuh-Rules

14 rules · 13 families
Detection Severity Format
Hyper-V volume shadow copy requestor service has been deleted on . Possible ransomware activity. · win.eventdata.targetObject = HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\vmicvss, win.eventdata.eventType = DeleteKey High Wazuh XML
Sysmon - Event 1: Process creation · Delete Backup Catalog (T1490) High Wazuh XML
Sysmon - Event 1: Process creation · Delete Backup Files (T1490) High Wazuh XML
Sysmon - Event 1: Process creation · Delete Shadows via vssadmin (T1490) High Wazuh XML
Sysmon - Event 1: Process creation · Delete Shadows via wmic (T1490) High Wazuh XML
Sysmon - Event 1: Process creation · Delete System State Backup (T1490) High Wazuh XML
Sysmon - Event 1: Process creation · Disable Recovery Console (T1490) High Wazuh XML
Sysmon - Event 1: Process creation · Disable SR Scheduled Task (T1490) High Wazuh XML
Sysmon - Event 1: Process creation · Disable System Restore (Registry) (T1490) High Wazuh XML
Sysmon - Event 1: Process creation · Modify VSS Permissions (T1490) High Wazuh XML

+ 4 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
Known Shadow Copy Delete command executed Undefined KQL
MITRE ATT&CK Mapping Undefined KQL

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Critical user management operations followed by disabling of System Restore from admin account Undefined KQL

chronicle/detection-rules

1 rule
Detection Severity Format
aws_backup_plan_deleted Low YARA-L

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.