T1490 Inhibit System Recovery
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Potential Dtrack RAT Activitycriticalstable · windows
- Potential Maze Ransomware Activitycriticaltest · windows
- WannaCry Ransomware Activitycriticaltest · windows
- Boot Configuration Tampering Via Bcdedit.EXEhighstable · windows
- Delete Volume Shadow Copies Via WMI With PowerShellhighstable · windows
- Shadow Copies Deletion Using Operating Systems Utilitieshighstable · windows
- All Backups Deleted Via Wbadmin.EXEhightest · windows
- Copy From VolumeShadowCopy Via Cmd.EXEhightest · windows
- Deletion of Volume Shadow Copies via WMI with PowerShellhightest · windows
- Deletion of Volume Shadow Copies via WMI with PowerShell - PS Scripthightest · windows
- Registry Disable System Restorehightest · windows
- Sensitive File Access Via Volume Shadow Copy Backuphightest · windows
- Suspicious Volume Shadow Copy VSS_PS.dll Loadhightest · windows
- Suspicious Volume Shadow Copy Vssapi.dll Loadhightest · windows
- System Restore Registry Modification via CommandLinehighexperimental · windows
- AWS S3 Bucket Versioning Disablemediumtest · aws
- Backup Files Deletedmediumtest · windows
- Cisco Modify Configurationmediumtest · cisco
- File Recovery From Backup Via Wbadmin.EXEmediumtest · windows
- New File Exclusion Added To Time Machine Via Tmutil - MacOSmediumtest · macos
- New Root or CA or AuthRoot Certificate to Storemediumtest · windows
- Potentially Suspicious Volume Shadow Copy Vsstrace.dll Loadmediumtest · windows
- Time Machine Backup Deletion Attempt Via Tmutil - MacOSmediumtest · macos
- Time Machine Backup Disabled Via Tmutil - MacOSmediumtest · macos
- Windows Backup Deleted Via Wbadmin.EXEmediumtest · windows
Showing 25 of 26.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.