Inhibit System Recovery T1490
Tactic: Impact
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.
Events covered
17 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 3 | Network connection |
| Sysmon | Event ID 5 | Process terminated |
| Sysmon | Event ID 7 | Image loaded |
| Sysmon | Event ID 11 | FileCreate |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 23 | FileDelete (File Delete archived) |
| Sysmon | Event ID 26 | FileDeleteDetected (File Delete logged) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 4689 | A process has exited. |
| Defender-DeviceProcessEvents | any | Process activity (any) |
| ESF | exec | Process Execution (Notify) |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| PowerShell | Event ID 400 | Event ID 400 |
| PowerShell | Event ID 800 | Event ID 800 |
| Service-Control-Manager | Event ID 7036 | The Microsoft Software Shadow Copy Provider service entered the stopped state. |
Authoring guide
Patterns shared across the 96 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (77 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (442 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (82 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 32 rules
- All Backups Deleted Via Wbadmin.EXE
- Amsi.DLL Load By Uncommon Process
- AWS S3 Bucket Versioning Disable
- Backup Files Deleted
- Boot Configuration Tampering Via Bcdedit.EXE
- Cisco Modify Configuration
- Copy From VolumeShadowCopy Via Cmd.EXE
- Delete Volume Shadow Copies Via WMI With PowerShell
- Deletion of Volume Shadow Copies via WMI with PowerShell
- Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script
- File Recovery From Backup Via Wbadmin.EXE
- New File Exclusion Added To Time Machine Via Tmutil - MacOS
- New Root or CA or AuthRoot Certificate to Store
- Potential Dtrack RAT Activity
- Potential Maze Ransomware Activity
- Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
- Registry Disable System Restore
- Sensitive File Access Via Volume Shadow Copy Backup
- Shadow Copies Deletion Using Operating Systems Utilities
- Suspicious Volume Shadow Copy VSS_PS.dll Load
- Suspicious Volume Shadow Copy Vssapi.dll Load
- System Restore Registry Modification via CommandLine
- Time Machine Backup Deletion Attempt Via Tmutil - MacOS
- Time Machine Backup Disabled Via Tmutil - MacOS
- VSS backup deletion (WMI)
- VSS backup deletion or resize
- VSS backup deletion via WMI (Powershell)
- WannaCry Ransomware Activity
- Windows Backup Deleted Via Wbadmin.EXE
- Windows native backup deletion
- Windows native backup size re-configuration
- Windows Recovery Environment Disabled Via Reagentc
Elastic 19 rules
- AWS EC2 EBS Snapshot Access Removed
- AWS RDS Snapshot Deleted
- AWS S3 Bucket Configuration Deletion
- AWS S3 Object Versioning Suspended
- Azure Compute Restore Point Collection Deleted by Unusual User
- Azure Compute Restore Point Collections Deleted
- Azure Compute Snapshot Deletion by Unusual User and Resource Group
- Azure Compute Snapshot Deletions by User
- Azure Recovery Services Resource Deleted
- Azure Resource Group Deleted
- Backup Deletion with Wbadmin
- Modification of Boot Configuration
- Potential Ransomware Note File Dropped via SMB
- Potential System Tampering via File Modification
- Suspicious File Renamed via SMB
- Third-party Backup Files Deleted via Unexpected Process
- Volume Shadow Copy Deleted or Resized via VssAdmin
- Volume Shadow Copy Deletion via PowerShell
- Volume Shadow Copy Deletion via WMIC
Splunk 17 rules
- ASL AWS Disable Bucket Versioning
- AWS Disable Bucket Versioning
- Bcdedit Command Back To Normal Mode Boot
- BCDEdit Failure Recovery Modification
- Change To Safe Mode With Network Config
- Delete ShadowCopy With PowerShell
- Deleting Shadow Copies
- Disabling SystemRestore In Registry
- Prevent Automatic Repair Mode using Bcdedit
- Resize ShadowStorage volume
- WBAdmin Delete System Backups
- Windows BitLocker Suspicious Command Usage
- Windows Cisco Secure Endpoint Related Service Stopped
- Windows Security And Backup Services Stop
- Windows Suspicious File in EFI Volume
- Windows WBAdmin File Recovery From Backup
- Windows WMIC Shadowcopy Delete
Kusto 9 rules
- CiscoISE - Backup failed
- Detect Malicious Usage of Recovery Tools to Delete Backup Files
- Detecting UAC bypass - ChangePK and SLUI registry tampering
- Detecting UAC bypass - elevated COM interface
- Detecting UAC bypass - modify Windows Store settings
- GCP Audit Logs - Detect Bulk VM Snapshot Deletion
- Potential Ransomware activity related to Cobalt Strike
- Shadow Copy Deletions
- SonicWall - Allowed SSH, Telnet, and RDP Connections
YARA-L 1 rule
Panther 18 rules
- AWS RDS Automated Backup Deleted
- AWS RDS Deletion Protection Disabled
- Azure Disk Deleted
- Azure Key Vault Deleted
- Azure Key Vault Key Permanently Purged
- Azure Key Vault Permanently Purged
- Azure Recovery Services Protection Container Deleted
- Azure Resource Lock Deleted
- Azure Restore Point Collection Deleted
- Azure SQL Server Deleted
- Azure Storage Account Deleted
- Azure Storage Blob CPK Encryption Detected
- Azure Storage Blob Deletion
- Azure Storage Blob Soft Delete Disabled
- Azure Storage Blob Upload FOLLOWED BY CPK Encryption Error
- Azure Storage Container Soft Delete Disabled
- Azure Storage Immutability Policy Deleted
- Azure VM Snapshot Deleted