T1490 Inhibit System Recovery

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. MITRE ATT&CK

3 programs on CmdID 16 Sigma rules T1490 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

reg.exeits Sigma rules vssadmin.exeTamper wbadmin.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

criticalPotential Dtrack RAT ActivityFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

criticalPotential Maze Ransomware ActivityFlorian Roth (Nextron Systems) · Windows

criticalWannaCry Ransomware ActivityFlorian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · Windows

highAll Backups Deleted Via Wbadmin.EXEfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows

highBoot Configuration Tampering Via Bcdedit.EXEE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · Windows

highCopy From VolumeShadowCopy Via Cmd.EXEMax Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) · Windows

highDeletion of Volume Shadow Copies via WMI with PowerShellTim Rauch, Elastic (idea) · Windows

highSensitive File Access Via Volume Shadow Copy BackupMax Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) · Windows

highShadow Copies Deletion Using Operating Systems UtilitiesFlorian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) · Windows

highSystem Restore Registry Modification via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumFile Recovery From Backup Via Wbadmin.EXENasreddine Bencherchali (Nextron Systems), frack113 · Windows

mediumNew File Exclusion Added To Time Machine Via Tmutil - MacOSPratinav Chandra · macOS

mediumTime Machine Backup Deletion Attempt Via Tmutil - MacOSPratinav Chandra · macOS

mediumTime Machine Backup Disabled Via Tmutil - MacOSPratinav Chandra · macOS

mediumWindows Backup Deleted Via Wbadmin.EXEfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumWindows Recovery Environment Disabled Via ReagentcDaniel Koifman (KoifSec), Michael Vilshin · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Disable automatic backups on the page for tmutil

sudo tmutil disableIdentify

To delete the oldest shadow copy of volume C, type on the page for vssadmin delete shadows

vssadmin delete shadows /for=c: /oldestIdentify

To delete all client-accessible shadow copies of volume D, type on the page for vssadmin delete shadows

vssadmin delete shadows /for=d: /allIdentify

To delete a single client-accessible shadow copy by its ID, first run vssadmin list shadows to find the shadow copy ID. Then run the following command, replacing c: with the volume that hosts the shadow copy and <ShadowID> with the ID you want to delete. Enter the ID in the format XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, where each X is a hexadecimal character on the page for vssadmin delete shadows

vssadmin delete shadows /for=c: /shadow=<ShadowID>Identify

To delete all client-accessible shadow copies of volume D without showing progress messages, add the /quiet parameter on the page for vssadmin delete shadows

vssadmin delete shadows /for=d: /all /quietIdentify

To resize shadow copy of volume C on volume D, with a maximum size of 900MB, type on the page for vssadmin resize shadowstorage

vssadmin resize shadowstorage /For=C: /On=D: /MaxSize=900MBIdentify

To resize shadow copy of volume C on volume D, with no maximum size, type on the page for vssadmin resize shadowstorage

vssadmin resize shadowstorage /For=C: /On=D: /MaxSize=UNBOUNDEDIdentify

To resize shadow copy of volume C by 20%, type on the page for vssadmin resize shadowstorage

vssadmin resize shadowstorage /For=C: /On=C: /MaxSize=20%Identify

To delete the system state backup created on March 31, 2013 at 10:00 AM, type on the page for wbadmin delete systemstatebackup

wbadmin delete systemstatebackup -version:03/31/2013-10:00Identify

To delete all system state backups, except the three most recent, type on the page for wbadmin delete systemstatebackup

wbadmin delete systemstatebackup -keepVersions:3Identify

To delete the oldest system state backup stored on disk f:, type on the page for wbadmin delete systemstatebackup

wbadmin delete systemstatebackup -backupTarget:f:\ -deleteOldestIdentify

An example is here when CmdID’s reading of it names T1490: a Sigma rule it trips is tagged with it, or its abuse is documented as it.