ATT&CK coverage › Technique
Inhibit System Recovery T1490
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.
Events covered
10 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 26 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (19 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (166 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 17 rules
- All Backups Deleted Via Wbadmin.EXE
- Backup Files Deleted
- Boot Configuration Tampering Via Bcdedit.EXE
- Copy From VolumeShadowCopy Via Cmd.EXE
- Delete Volume Shadow Copies Via WMI With PowerShell
- Deletion of Volume Shadow Copies via WMI with PowerShell
- Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script
- File Recovery From Backup Via Wbadmin.EXE
- New Root or CA or AuthRoot Certificate to Store
- Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
- Registry Disable System Restore
- Sensitive File Access Via Volume Shadow Copy Backup
- Shadow Copies Deletion Using Operating Systems Utilities
- Suspicious Volume Shadow Copy VSS_PS.dll Load
- Suspicious Volume Shadow Copy Vssapi.dll Load
- Windows Backup Deleted Via Wbadmin.EXE
- Windows Recovery Environment Disabled Via Reagentc
Splunk 5 rules
- Delete ShadowCopy With PowerShell
- Disabling SystemRestore In Registry
- Windows Cisco Secure Endpoint Related Service Stopped
- Windows Security And Backup Services Stop
- Windows WMIC Shadowcopy Delete