T1490: Inhibit System Recovery
| View on MITRE ATT&CK | T1490 |
|---|---|
| Tactic(s) | Impact |
Data from MITRE ATT&CK®:
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.
Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
vssadmin.execan be used to delete all volume shadow copies on a system -vssadmin.exe delete shadows /all /quiet- Windows Management Instrumentation can be used to delete volume shadow copies -
wmic shadowcopy delete wbadmin.execan be used to delete the Windows Backup Catalog -wbadmin.exe delete catalog -quietbcdedit.execan be used to disable automatic Windows recovery features by modifying boot configuration data -bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled noREAgentC.execan be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system
On network devices, adversaries may leverage Disk Wipe to delete backup firmware images and reformat the file system, then System Shutdown/Reboot to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.
Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware)
© 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Cyber Threat Graph Context
Explore how this ATT&CK Technique relates to the wider threat graph
Reporting on this Technique
StopRansomware: Phobos Ransomware
This is a joint Cybersecurity Advisory produced by CISA, the FBI and the Multi-State Information Sharing and Analysis Center (MS-ISAC). It ...
AA24-109A StopRansomware: Akira Ransomware
This is a joint #StopRansomware advisory issued by CISA and partners covering Akira ransomware attacks. According to the report, the group has ...
#StopRansomware: LockBit 3.0
This #StopRansomware Cybersecurity Advisory from CISA and partners describes the operations associated with LockBit 3.0 which operates as a ...
Threat Assessment: Black Basta Ransomware
This threat assessment from Palo Alto's Unit 42 describes the Black Basta 'Ransomware as a Service' operation including TTPs (tactics, techniques ...
Ransomware Spotlight: Black Basta
This report from Trend Micro outlines tactics, techniques and procedures used by the Black Basta Ransomware group. According to the report, Black ...
Mitigations for this technique
MITRE ATT&CK Mitigations
Operating System Configuration
Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.User Account Management
Manage the creation, modification, use, and permissions associated to user accounts.Data Backup
Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.How to detect this technique
MITRE ATT&CK Data Components
Command Execution (Command)
The execution of a line of text, potentially with arguments, created from program code (e.g. a cmdlet executed via powershell.exe, interactive commands like >dir, shell executions, etc. )File Deletion (File)
Removal of a file (ex: Sysmon EID 23, macOS ESF EID ES_EVENT_TYPE_AUTH_UNLINK, or Linux commands auditd unlink, rename, rmdir, unlinked, or renameat rules)Windows Registry Key Modification (Windows Registry)
Changes made to a Registry Key and/or Key value (ex: Windows EID 4657 or Sysmon EID 13|14)Service Metadata (Service)
Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.Snapshot Deletion (Snapshot)
Removal of a snapshot (ex: AWS delete-snapshot)Process Creation (Process)
The initial construction of an executable managed by the OS, that may involve one or more tasks or threads. (e.g. Win EID 4688, Sysmon EID 1, cmd.exe > net use, etc.)Cloud Storage Deletion (Cloud Storage)
Removal of cloud storage infrastructure (ex: AWS S3 DeleteBucket)Control Validation Tests for this Technique
Use Atomic Red Team tests to test your defenses against this technique.
Windows - Delete Backup Files
Windows - Disable Windows Recovery Console Repair
Windows - Disable the SR scheduled task
Disable Time Machine
Windows - Delete Volume Shadow Copies via WMI
Modify VSS Service Permissions
Windows - vssadmin Resize Shadowstorage Volume
Disable System Restore Through Registry
Windows - Delete Volume Shadow Copies via WMI with PowerShell
Windows - Delete Volume Shadow Copies
Windows - wbadmin Delete systemstatebackup
Windows - wbadmin Delete Windows Backup Catalog
Sigma Detections for this Technique
Delete Volume Shadow Copies via WMI with PowerShell - PS Script
Sensitive File Access Via Volume Shadow Copy Backup
Delete Volume Shadow Copies Via WMI With PowerShell
Suspicious Volume Shadow Copy Vsstrace.dll Load
Copy From VolumeShadowCopy Via Cmd.EXE
Shadow Copies Deletion Using Operating Systems Utilities
Backup Files Deleted
Suspicious Volume Shadow Copy Vssapi.dll Load
SystemStateBackup Deleted Using Wbadmin.EXE
New Root or CA or AuthRoot Certificate to Store
Registry Disable System Restore
Cisco Modify Configuration
Boot Configuration Tampering Via Bcdedit.EXE
Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script
Suspicious Volume Shadow Copy VSS_PS.dll Load
Deletion of Volume Shadow Copies via WMI with PowerShell
AWS S3 Bucket Versioning Disable
SP800-53 Controls
See which controls can help protect against this MITRE ATT&CK technique. This is based on mappings to associated SP800-53 controls produced by the MITRE Engenuity Center for Threat-Informed Defense.