Inhibit System Recovery T1490
Tactic: Impact
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.
Events covered
19 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 5 | Process terminated |
| Sysmon | Event ID 7 | Image loaded |
| Sysmon | Event ID 11 | FileCreate |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 23 | FileDelete (File Delete archived) |
| Sysmon | Event ID 26 | FileDeleteDetected (File Delete logged) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 4689 | A process has exited. |
| Defender-AlertEvidence | any | Alert evidence |
| Defender-AlertInfo | any | Alert information |
| Defender-DeviceLogonEvents | any | Logon activity |
| Defender-DeviceProcessEvents | any | Process activity |
| ESF | exec | Process Execution |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| PowerShell | Event ID 400 | Event ID 400 |
| PowerShell | Event ID 800 | Event ID 800 |
| Service-Control-Manager | Event ID 7036 | The Microsoft Software Shadow Copy Provider service entered the stopped state. |
Authoring guide
These 116 rules share fields, values, and exclusions.
Fields filtered most (79 distinct)
These fields appear most often in rule filters.
Top indicator values (564 distinct)
These values appear most often in rule predicates.
Exclusions (182 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 32 rules
- All Backups Deleted Via Wbadmin.EXE
- Amsi.DLL Load By Uncommon Process
- AWS S3 Bucket Versioning Disable
- Backup Files Deleted
- Boot Configuration Tampering Via Bcdedit.EXE
- Cisco Modify Configuration
- Copy From VolumeShadowCopy Via Cmd.EXE
- Delete Volume Shadow Copies Via WMI With PowerShell
- Deletion of Volume Shadow Copies via WMI with PowerShell
- Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script
- File Recovery From Backup Via Wbadmin.EXE
- New File Exclusion Added To Time Machine Via Tmutil - MacOS
- New Root or CA or AuthRoot Certificate to Store
- Potential Dtrack RAT Activity
- Potential Maze Ransomware Activity
- Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
- Registry Disable System Restore
- Sensitive File Access Via Volume Shadow Copy Backup
- Shadow Copies Deletion Using Operating Systems Utilities
- Suspicious Volume Shadow Copy VSS_PS.dll Load
- Suspicious Volume Shadow Copy Vssapi.dll Load
- System Restore Registry Modification via CommandLine
- Time Machine Backup Deletion Attempt Via Tmutil - MacOS
- Time Machine Backup Disabled Via Tmutil - MacOS
- VSS backup deletion (WMI)
- VSS backup deletion or resize
- VSS backup deletion via WMI (Powershell)
- WannaCry Ransomware Activity
- Windows Backup Deleted Via Wbadmin.EXE
- Windows native backup deletion
- Windows native backup size re-configuration
- Windows Recovery Environment Disabled Via Reagentc
Elastic 38 rules
- AWS Backup Recovery Point Deleted
- AWS Backup Vault Deleted or Vault Lock Removed
- AWS EC2 EBS Snapshot Access Removed
- AWS RDS Snapshot Deleted
- AWS S3 Bucket Configuration Deletion
- AWS S3 Bucket MFA Delete Disabled
- AWS S3 Object Versioning Suspended
- Azure Compute Restore Point Collection Deleted by Unusual User
- Azure Compute Restore Point Collections Deleted
- Azure Compute Snapshot Deletion by Unusual User and Resource Group
- Azure Compute Snapshot Deletions by User
- Azure Recovery Services Resource Deleted
- Azure Resource Group Deleted
- Backup Deletion with Wbadmin
- BCDEdit Safe Mode Command Execution
- Inhibit System Recovery Followed by a Suspicious File Rename
- Inhibit System Recovery via Microsoft Office Process
- Inhibit System Recovery via Obfuscated Commands
- Inhibit System Recovery via Renamed Utilities
- Inhibit System Recovery via Signed Binary Proxy
- Inhibit System Recovery via Stopping Backup Services
- Inhibit System Recovery via Untrusted Parent Process
- Inhibit System Recovery via Windows Command Shell
- Modification of Boot Configuration
- Potential Ransomware Note File Dropped via SMB
- Potential System Tampering via File Modification
- Shadow Copy Deletion via Windows Management Instrumentation
- Shadow Copy Service Disabled via Registry Modification
- Suspicious Critical System Files Modification
- Suspicious File Rename by an Unusual Process
- Suspicious File Rename from Unbacked Memory
- Suspicious File Rename via SMB
- Suspicious File Renamed via SMB
- Third-party Backup Files Deleted via Unexpected Process
- Volume Shadow Copy Deleted or Resized via VssAdmin
- Volume Shadow Copy Deletion via PowerShell
- Volume Shadow Copy Deletion via WMIC
- VSS Service Disabled Followed by a Suspicious File Rename
Splunk 17 rules
- ASL AWS Disable Bucket Versioning
- AWS Disable Bucket Versioning
- Bcdedit Command Back To Normal Mode Boot
- BCDEdit Failure Recovery Modification
- Change To Safe Mode With Network Config
- Delete ShadowCopy With PowerShell
- Deleting Shadow Copies
- Disabling SystemRestore In Registry
- Prevent Automatic Repair Mode using Bcdedit
- Resize ShadowStorage volume
- WBAdmin Delete System Backups
- Windows BitLocker Suspicious Command Usage
- Windows Cisco Secure Endpoint Related Service Stopped
- Windows Security And Backup Services Stop
- Windows Suspicious File in EFI Volume
- Windows WBAdmin File Recovery From Backup
- Windows WMIC Shadowcopy Delete
Kusto 10 rules
- CiscoISE - Backup failed
- Detect Malicious Usage of Recovery Tools to Delete Backup Files
- Detecting UAC bypass - ChangePK and SLUI registry tampering
- Detecting UAC bypass - elevated COM interface
- Detecting UAC bypass - modify Windows Store settings
- Gambit Security - Critical Policy Issue Promotion
- GCP Audit Logs - Detect Bulk VM Snapshot Deletion
- Potential Ransomware activity related to Cobalt Strike
- Shadow Copy Deletions
- SonicWall - Allowed SSH, Telnet, and RDP Connections
YARA-L 1 rule
Panther 18 rules
- AWS RDS Automated Backup Deleted
- AWS RDS Deletion Protection Disabled
- Azure Disk Deleted
- Azure Key Vault Deleted
- Azure Key Vault Key Permanently Purged
- Azure Key Vault Permanently Purged
- Azure Recovery Services Protection Container Deleted
- Azure Resource Lock Deleted
- Azure Restore Point Collection Deleted
- Azure SQL Server Deleted
- Azure Storage Account Deleted
- Azure Storage Blob CPK Encryption Detected
- Azure Storage Blob Deletion
- Azure Storage Blob Soft Delete Disabled
- Azure Storage Blob Upload WITH CPK Encryption Error
- Azure Storage Container Soft Delete Disabled
- Azure Storage Immutability Policy Deleted
- Azure VM Snapshot Deleted