kevmap

Techniques › T1490

T1490 Inhibit System Recovery

impact — Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
5
analytics
27
Sigma rules tagged attack.t1490
2
KEV CVEs mapped here
<p>Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.</p><p>Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact. Furthermore, adversaries may disable recovery notifications, then corrupt backups.</p><p>A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:</p>
    <li><code>vssadmin.exe</code> can be used to delete all volume shadow copies on a system - <code>vssadmin.exe delete shadows /all /quiet</code></li><li>Windows Management Instrumentation can be used to delete volume shadow copies - <code>wmic shadowcopy delete</code></li><li><code>wbadmin.exe</code> can be used to delete the Windows Backup Catalog - <code>wbadmin.exe delete catalog -quiet</code></li><li><code>bcdedit.exe</code> can be used to disable automatic Windows recovery features by modifying boot configuration data - <code>bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no</code></li><li><code>REAgentC.exe</code> can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system</li><li><code>diskshadow.exe</code> can be used to delete all volume shadow copies on a system - <code>diskshadow delete shadows all</code></li>
<p>On network devices, adversaries may leverage Disk Wipe to delete backup firmware images and reformat the file system, then System Shutdown/Reboot to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.</p><p>On ESXi servers, adversaries may delete or encrypt snapshots of virtual machines to support Data Encrypted for Impact, preventing them from being leveraged as backups (e.g., via vim-cmd vmsvc/snapshot.removeall).</p><p>Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services. In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVEVendor / productMapping typeStateAdded
CVE-2025-21391Microsoft Windows primary impact Mapped2025-02-11
CVE-2023-36884Microsoft Windows secondary impact Stale2023-07-17

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1490

Backup Files Deleted mediumtest
Author: frack113 · 2022-01-02 (modified 2023-02-15) · logsource: product=windows category=file_delete · 06125661-3814-4e03-bfa2-1e4411c60ac3
Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Techniques: T1490
Boot Configuration Tampering Via Bcdedit.EXE highstable
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2019-10-24 (modified 2023-02-15) · logsource: product=windows category=process_creation · 1444443e-6757-43e4-9ea4-c8fc705f79a2
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.
Techniques: T1490
Deletion of Volume Shadow Copies via WMI with PowerShell hightest
Author: Tim Rauch, Elastic (idea) · 2022-09-20 (modified 2022-12-30) · logsource: product=windows category=process_creation · 21ff4ca9-f13a-41ad-b828-0077b2af2e40
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
Techniques: T1490
Potential Maze Ransomware Activity criticaltest
Author: Florian Roth (Nextron Systems) · 2020-05-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 29fd07fc-9cfd-4331-b7fd-cc18dfa21052
Detects specific process characteristics of Maze ransomware word document droppers
Techniques: T1204.002T1047T1490
Time Machine Backup Disabled Via Tmutil - MacOS mediumtest
Author: Pratinav Chandra · 2024-05-29 · logsource: product=macos category=process_creation · 2c95fa8a-8b8d-4787-afce-7117ceb8e3da
Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.
Techniques: T1490
Suspicious Volume Shadow Copy VSS_PS.dll Load hightest
Author: Markus Neis, @markus_neis · 2021-07-07 (modified 2025-07-11) · logsource: product=windows category=image_load · 333cdbe8-27bb-4246-bf82-b41a0dca4b70
Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
Techniques: T1490
Suspicious Volume Shadow Copy Vssapi.dll Load hightest
Author: frack113 · 2022-10-31 (modified 2026-05-18) · logsource: product=windows category=image_load · 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8
Detects the image load of VSS DLL by uncommon executables
Techniques: T1490
WannaCry Ransomware Activity criticaltest
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079
Detects WannaCry ransomware activity
Techniques: T1210T1083T1222.001T1486T1490
Time Machine Backup Deletion Attempt Via Tmutil - MacOS mediumtest
Author: Pratinav Chandra · 2024-05-29 · logsource: product=macos category=process_creation · 452df256-da78-427a-866f-49fa04417d74
Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.
Techniques: T1490
Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load mediumtest
Author: frack113 · 2023-02-17 (modified 2025-12-03) · logsource: product=windows category=image_load · 48bfd177-7cf2-412b-ad77-baf923489e82
Detects the image load of VSS DLL by uncommon executables
Techniques: T1490
Registry Disable System Restore hightest
Author: frack113 · 2022-04-04 (modified 2023-08-17) · logsource: product=windows category=registry_set · 5de03871-5d46-4539-a82d-3aa992a69a83
Detects the modification of the registry to disable a system restore on the computer
Techniques: T1490
All Backups Deleted Via Wbadmin.EXE hightest
Author: frack113, Nasreddine Bencherchali (Nextron Systems) · 2021-12-13 (modified 2024-05-10) · logsource: product=windows category=process_creation · 639c9081-f482-47d3-a0bd-ddee3d4ecd76
Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
Techniques: T1490
Cisco Modify Configuration mediumtest
Author: Austin Clark · 2019-08-12 (modified 2025-04-28) · logsource: product=cisco service=aaa · 671ffc77-50a7-464f-9e3d-9ea2b493b26b
Modifications to a config that will serve an adversary's impacts or persistence
Techniques: T1490T1505T1565.002T1053
File Recovery From Backup Via Wbadmin.EXE mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2024-05-10 · logsource: product=windows category=process_creation · 6fe4aa1e-0531-4510-8be2-782154b73b48
Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.
Techniques: T1490
System Restore Registry Modification via CommandLine highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-03-11 · logsource: product=windows category=process_creation · 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9
Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.
Techniques: T1490
Delete Volume Shadow Copies Via WMI With PowerShell highstable
Author: frack113 · 2021-06-03 (modified 2023-10-27) · logsource: product=windows category=ps_classic_start · 87df9ee1-5416-453a-8a08-e8d4a51e9ce1
Shadow Copies deletion using operating systems utilities via PowerShell
Techniques: T1490
Windows Backup Deleted Via Wbadmin.EXE mediumtest
Author: frack113, Nasreddine Bencherchali (Nextron Systems) · 2021-12-13 (modified 2024-05-10) · logsource: product=windows category=process_creation · 89f75308-5b1b-4390-b2d8-d6b2340efaf8
Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.
Techniques: T1490
New File Exclusion Added To Time Machine Via Tmutil - MacOS mediumtest
Author: Pratinav Chandra · 2024-05-29 · logsource: product=macos category=process_creation · 9acf45ed-3a26-4062-bf08-56857613eb52
Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.
Techniques: T1490
AWS S3 Bucket Versioning Disable mediumtest
Author: Sean Johnstone | Unit 42 · 2023-10-28 · logsource: product=aws service=cloudtrail · a136ac98-b2bc-4189-a14d-f0d0388e57a7
Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.
Techniques: T1490
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script hightest
Author: Tim Rauch, frack113 · 2022-09-20 (modified 2022-12-02) · logsource: product=windows category=ps_script · c1337eb8-921a-4b59-855b-4ba188ddcc42
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil
Techniques: T1490
Copy From VolumeShadowCopy Via Cmd.EXE hightest
Author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) · 2021-08-09 (modified 2023-03-07) · logsource: product=windows category=process_creation · c73124a7-3e89-44a3-bdc1-25fe4df754b1
Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)
Techniques: T1490
Shadow Copies Deletion Using Operating Systems Utilities highstable
Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) · 2019-10-22 (modified 2022-11-03) · logsource: product=windows category=process_creation · c947b146-0abc-4c87-9c64-b17e9d7274a2
Shadow Copies deletion using operating systems utilities
Techniques: T1070T1490
New Root or CA or AuthRoot Certificate to Store mediumtest
Author: frack113 · 2022-04-04 (modified 2023-08-17) · logsource: product=windows category=registry_set · d223b46b-5621-4037-88fe-fda32eead684
Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
Techniques: T1490
Windows Recovery Environment Disabled Via Reagentc mediumexperimental
Author: Daniel Koifman (KoifSec), Michael Vilshin · 2025-07-31 · logsource: product=windows category=process_creation · db1c21e4-cd66-4b4e-85ca-590f0780529c
Detects attempts to disable windows recovery environment using Reagentc. ReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE). It allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.
Techniques: T1490
Potential Dtrack RAT Activity criticalstable
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2019-10-30 (modified 2025-11-03) · logsource: product=windows category=process_creation · f1531fa4-5b84-4342-8f68-9cf3fdbd83d4
Detects potential Dtrack RAT activity via specific process patterns
Techniques: T1490
Sensitive File Access Via Volume Shadow Copy Backup hightest
Author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) · 2021-08-09 (modified 2024-01-18) · logsource: product=windows category=process_creation · f57f8d16-1f39-4dcb-a604-6c73d9b54b3d
Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)
Techniques: T1490
Amsi.DLL Load By Uncommon Process lowtest
Author: frack113 · 2023-03-12 (modified 2026-06-29) · logsource: product=windows category=image_load · facd1549-e416-48e0-b8c4-41d7215eedc8
Detects loading of Amsi.dll by uncommon processes
Techniques: T1490