{"id":"T1490","name":"Inhibit System Recovery","url":"https://attack.mitre.org/techniques/T1490","tactics":["impact"],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0329","stix_id":"x-mitre-detection-strategy--b13116ed-e9c0-4cd5-81f6-676074078477","name":"Behavioral Detection for T1490 - Inhibit System Recovery","url":"https://attack.mitre.org/detectionstrategies/DET0329","analytics":[{"id":"AN0933","stix_id":"x-mitre-analytic--decb2be7-1a0a-46dd-ab48-cf6258c0185e","name":"Analytic 0933","description":"Process chains that use native utilities (vssadmin, wbadmin, diskshadow, bcdedit, REAgentC, wmic) with arguments to delete shadow copies, disable recovery, or remove backup catalogs","url":"https://attack.mitre.org/detectionstrategies/DET0329#AN0933","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Microsoft-Windows-Backup","channel":"Windows Backup Catalog deletion or catalog corruption","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"wineventlog-microsoft-windows-backup"},{"name":"WinEventLog:System","channel":"Service stopped or RecoveryDisabled set via REAgentC","data_component":"DC0041","data_component_name":"Service Metadata","log_source_slug":"wineventlog-system"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Used to track rapid recovery feature changes over short intervals"},{"field":"CommandLinePattern","description":"Can be tuned to catch variations in destructive flags (/all, /quiet, -delete)"},{"field":"ParentProcessContext","description":"Tune based on common parent-child chains (e.g., powershell → diskshadow)"}],"live":true,"detection_strategies":["DET0329"],"techniques":["T1490"]},{"id":"AN0934","stix_id":"x-mitre-analytic--135452f6-c760-42a6-8a3f-d09c33f05369","name":"Analytic 0934","description":"Shell utilities or scripts deleting `/etc/systemd/system/rescue.target`, `/etc/fstab` backups, or `/boot/efi` partitions; chattr used to block snapshot auto-recovery","url":"https://attack.mitre.org/detectionstrategies/DET0329#AN0934","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"chattr, rm, shred, dd run on recovery directories or partitions","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"},{"name":"auditd:CONFIG_CHANGE","channel":"/etc/fstab, /etc/systemd/*","data_component":"DC0040","data_component_name":"File Deletion","log_source_slug":"auditd-config-change"}],"mutable_elements":[{"field":"WatchedFilePaths","description":"Modify to include specific OS backup configs or LVM snapshots"},{"field":"ShellProcessUser","description":"Restrict detection to root or sudo users"}],"live":true,"detection_strategies":["DET0329"],"techniques":["T1490"]},{"id":"AN0935","stix_id":"x-mitre-analytic--e2fb4be5-bd70-45d6-89ad-e687bc475285","name":"Analytic 0935","description":"ESXi shell or vim-cmd execution that deletes all VM snapshots using vmsvc/snapshot.removeall or rm on snapshot paths","url":"https://attack.mitre.org/detectionstrategies/DET0329#AN0935","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"snapshot.removeall or snapshot file deletion","data_component":"DC0049","data_component_name":"Snapshot Deletion","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"TargetVMNames","description":"Limit to critical VM names to reduce false positives"}],"live":true,"detection_strategies":["DET0329"],"techniques":["T1490"]},{"id":"AN0936","stix_id":"x-mitre-analytic--55a0743e-cdc1-44d1-94c7-cf3837e3ef2f","name":"Analytic 0936","description":"Execution of `erase`, `format`, and `reload` in immediate sequence from a privileged AAA session","url":"https://attack.mitre.org/detectionstrategies/DET0329#AN0936","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"command sequence: erase → format → reload","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"CommandSequenceWindow","description":"Time between erase and reload command to establish causality"},{"field":"UserPrivilegeLevel","description":"Filter for high-privilege user sessions"}],"live":true,"detection_strategies":["DET0329"],"techniques":["T1490"]},{"id":"AN0937","stix_id":"x-mitre-analytic--e50f8247-73da-4461-a560-745ed84f1209","name":"Analytic 0937","description":"Cloud API calls disabling snapshot scheduling, backup policies, versioning, followed by DeleteSnapshot/DeleteVolume operations","url":"https://attack.mitre.org/detectionstrategies/DET0329#AN0937","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"DeleteSnapshot","data_component":"DC0049","data_component_name":"Snapshot Deletion","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances","data_component":"DC0022","data_component_name":"Cloud Storage Deletion","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"UserAgent","description":"Tune for legitimate backup automation vs unknown tools"},{"field":"ResourceType","description":"Filter only on production images or vaults"}],"live":true,"detection_strategies":["DET0329"],"techniques":["T1490"]}],"live":true,"version":"1.0","techniques":["T1490"]}],"sigma_rules":[{"id":"06125661-3814-4e03-bfa2-1e4411c60ac3","title":"Backup Files Deleted","author":"frack113","status":"test","level":"medium","date":"2022-01-02","modified":"2023-02-15","description":"Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files"],"logsource":{"product":"windows","category":"file_delete"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/file/file_delete/file_delete_win_delete_backup_file.yml","techniques":["T1490"],"cves":[]},{"id":"1444443e-6757-43e4-9ea4-c8fc705f79a2","title":"Boot Configuration Tampering Via Bcdedit.EXE","author":"E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","status":"stable","level":"high","date":"2019-10-24","modified":"2023-02-15","description":"Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md","https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml","techniques":["T1490"],"cves":[]},{"id":"21ff4ca9-f13a-41ad-b828-0077b2af2e40","title":"Deletion of Volume Shadow Copies via WMI with PowerShell","author":"Tim Rauch, Elastic (idea)","status":"test","level":"high","date":"2022-09-20","modified":"2022-12-30","description":"Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell","https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/process_creation/proc_creation_win_powershell_shadowcopy_deletion.yml","techniques":["T1490"],"cves":[]},{"id":"29fd07fc-9cfd-4331-b7fd-cc18dfa21052","title":"Potential Maze Ransomware Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-05-08","modified":"2023-02-13","description":"Detects specific process characteristics of Maze ransomware word document droppers","references":["https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html","https://app.any.run/tasks/51e7185c-52d7-4efb-ac0d-e86340053473/","https://app.any.run/tasks/65a79440-373a-4725-8d74-77db9f2abda4/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1204.002","attack.t1047","attack.impact","attack.t1490","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Malware/Maze/proc_creation_win_malware_maze_ransomware.yml","techniques":["T1204.002","T1047","T1490"],"cves":[]},{"id":"2c95fa8a-8b8d-4787-afce-7117ceb8e3da","title":"Time Machine Backup Disabled Via Tmutil - MacOS","author":"Pratinav Chandra","status":"test","level":"medium","date":"2024-05-29","modified":null,"description":"Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility \"tmutil\".\nAn attacker can use this to prevent backups from occurring.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine","https://www.loobins.io/binaries/tmutil/"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml","techniques":["T1490"],"cves":[]},{"id":"333cdbe8-27bb-4246-bf82-b41a0dca4b70","title":"Suspicious Volume Shadow Copy VSS_PS.dll Load","author":"Markus Neis, @markus_neis","status":"test","level":"high","date":"2021-07-07","modified":"2025-07-11","description":"Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes.\nIt is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.\nThe fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.\n","references":["https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add","https://twitter.com/am0nsec/status/1412232114980982787"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/image_load/image_load_dll_vss_ps_susp_load.yml","techniques":["T1490"],"cves":[]},{"id":"37774c23-25a1-4adb-bb6d-8bb9fd59c0f8","title":"Suspicious Volume Shadow Copy Vssapi.dll Load","author":"frack113","status":"test","level":"high","date":"2022-10-31","modified":"2026-05-18","description":"Detects the image load of VSS DLL by uncommon executables","references":["https://github.com/ORCx41/DeleteShadowCopies"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/image_load/image_load_dll_vssapi_susp_load.yml","techniques":["T1490"],"cves":[]},{"id":"41d40bff-377a-43e2-8e1b-2e543069e079","title":"WannaCry Ransomware Activity","author":"Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro","status":"test","level":"critical","date":"2019-01-16","modified":"2025-10-18","description":"Detects WannaCry ransomware activity","references":["https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100","https://x.com/nas_bench/status/1868639048484425963"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.defense-impairment","attack.t1210","attack.discovery","attack.t1083","attack.t1222.001","attack.impact","attack.t1486","attack.t1490","detection.emerging-threats"],"path":"rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml","techniques":["T1210","T1083","T1222.001","T1486","T1490"],"cves":[]},{"id":"452df256-da78-427a-866f-49fa04417d74","title":"Time Machine Backup Deletion Attempt Via Tmutil - MacOS","author":"Pratinav Chandra","status":"test","level":"medium","date":"2024-05-29","modified":null,"description":"Detects deletion attempts of MacOS Time Machine backups via the native backup utility \"tmutil\".\nAn adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine","https://www.loobins.io/binaries/tmutil/"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml","techniques":["T1490"],"cves":[]},{"id":"48bfd177-7cf2-412b-ad77-baf923489e82","title":"Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load","author":"frack113","status":"test","level":"medium","date":"2023-02-17","modified":"2025-12-03","description":"Detects the image load of VSS DLL by uncommon executables","references":["https://github.com/ORCx41/DeleteShadowCopies"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/image_load/image_load_dll_vsstrace_susp_load.yml","techniques":["T1490"],"cves":[]},{"id":"5de03871-5d46-4539-a82d-3aa992a69a83","title":"Registry Disable System Restore","author":"frack113","status":"test","level":"high","date":"2022-04-04","modified":"2023-08-17","description":"Detects the modification of the registry to disable a system restore on the computer","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/registry/registry_set/registry_set_disable_system_restore.yml","techniques":["T1490"],"cves":[]},{"id":"639c9081-f482-47d3-a0bd-ddee3d4ecd76","title":"All Backups Deleted Via Wbadmin.EXE","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-12-13","modified":"2024-05-10","description":"Detects the deletion of all backups or system state backups via \"wbadmin.exe\".\nThis technique is used by numerous ransomware families and actors.\nThis may only be successful on server platforms that have Windows Backup enabled.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell","https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md","https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/","https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml","techniques":["T1490"],"cves":[]},{"id":"671ffc77-50a7-464f-9e3d-9ea2b493b26b","title":"Cisco Modify Configuration","author":"Austin Clark","status":"test","level":"medium","date":"2019-08-12","modified":"2025-04-28","description":"Modifications to a config that will serve an adversary's impacts or persistence","references":[],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.impact","attack.t1490","attack.t1505","attack.t1565.002","attack.t1053"],"path":"rules/network/cisco/aaa/cisco_cli_modify_config.yml","techniques":["T1490","T1505","T1565.002","T1053"],"cves":[]},{"id":"6fe4aa1e-0531-4510-8be2-782154b73b48","title":"File Recovery From Backup Via Wbadmin.EXE","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2024-05-10","modified":null,"description":"Detects the recovery of files from backups via \"wbadmin.exe\".\nAttackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.\n","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery","https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml","techniques":["T1490"],"cves":[]},{"id":"7c06ab9b-b1d2-4ba9-b06e-09491ded20d9","title":"System Restore Registry Modification via CommandLine","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-03-11","modified":null,"description":"Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/process_creation/proc_creation_win_reg_system_restore_modification.yml","techniques":["T1490"],"cves":[]},{"id":"87df9ee1-5416-453a-8a08-e8d4a51e9ce1","title":"Delete Volume Shadow Copies Via WMI With PowerShell","author":"frack113","status":"stable","level":"high","date":"2021-06-03","modified":"2023-10-27","description":"Shadow Copies deletion using operating systems utilities via PowerShell","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md","https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml","techniques":["T1490"],"cves":[]},{"id":"89f75308-5b1b-4390-b2d8-d6b2340efaf8","title":"Windows Backup Deleted Via Wbadmin.EXE","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2021-12-13","modified":"2024-05-10","description":"Detects the deletion of backups or system state backups via \"wbadmin.exe\".\nThis technique is used by numerous ransomware families and actors.\nThis may only be successful on server platforms that have Windows Backup enabled.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell","https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md","https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/","https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted","https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/process_creation/proc_creation_win_wbadmin_delete_backups.yml","techniques":["T1490"],"cves":[]},{"id":"9acf45ed-3a26-4062-bf08-56857613eb52","title":"New File Exclusion Added To Time Machine Via Tmutil - MacOS","author":"Pratinav Chandra","status":"test","level":"medium","date":"2024-05-29","modified":null,"description":"Detects the addition of a new file or path exclusion to MacOS Time Machine via the \"tmutil\" utility.\nAn adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine","https://www.loobins.io/binaries/tmutil/"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml","techniques":["T1490"],"cves":[]},{"id":"a136ac98-b2bc-4189-a14d-f0d0388e57a7","title":"AWS S3 Bucket Versioning Disable","author":"Sean Johnstone | Unit 42","status":"test","level":"medium","date":"2023-10-28","modified":null,"description":"Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.","references":["https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.impact","attack.t1490"],"path":"rules/cloud/aws/cloudtrail/aws_disable_bucket_versioning.yml","techniques":["T1490"],"cves":[]},{"id":"c1337eb8-921a-4b59-855b-4ba188ddcc42","title":"Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script","author":"Tim Rauch, frack113","status":"test","level":"high","date":"2022-09-20","modified":"2022-12-02","description":"Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell","https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml","techniques":["T1490"],"cves":[]},{"id":"c73124a7-3e89-44a3-bdc1-25fe4df754b1","title":"Copy From VolumeShadowCopy Via Cmd.EXE","author":"Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)","status":"test","level":"high","date":"2021-08-09","modified":"2023-03-07","description":"Detects the execution of the builtin \"copy\" command that targets a shadow copy (sometimes used to copy registry hives that are in use)","references":["https://twitter.com/vxunderground/status/1423336151860002816?s=20","https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection","https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/process_creation/proc_creation_win_cmd_shadowcopy_access.yml","techniques":["T1490"],"cves":[]},{"id":"c947b146-0abc-4c87-9c64-b17e9d7274a2","title":"Shadow Copies Deletion Using Operating Systems Utilities","author":"Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)","status":"stable","level":"high","date":"2019-10-22","modified":"2022-11-03","description":"Shadow Copies deletion using operating systems utilities","references":["https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment","https://blog.talosintelligence.com/2017/05/wannacry.html","https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/","https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/","https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100","https://github.com/Neo23x0/Raccine#the-process","https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar","https://redcanary.com/blog/intelligence-insights-october-2021/","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.stealth","attack.t1070","attack.t1490"],"path":"rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml","techniques":["T1070","T1490"],"cves":[]},{"id":"d223b46b-5621-4037-88fe-fda32eead684","title":"New Root or CA or AuthRoot Certificate to Store","author":"frack113","status":"test","level":"medium","date":"2022-04-04","modified":"2023-08-17","description":"Detects the addition of new root, CA or AuthRoot certificates to the Windows registry","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store","https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml","techniques":["T1490"],"cves":[]},{"id":"db1c21e4-cd66-4b4e-85ca-590f0780529c","title":"Windows Recovery Environment Disabled Via Reagentc","author":"Daniel Koifman (KoifSec), Michael Vilshin","status":"experimental","level":"medium","date":"2025-07-31","modified":null,"description":"Detects attempts to disable windows recovery environment using Reagentc.\nReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE).\nIt allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.\n","references":["https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes","https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/process_creation/proc_creation_win_reagentc_disable_windows_recovery_environment.yml","techniques":["T1490"],"cves":[]},{"id":"f1531fa4-5b84-4342-8f68-9cf3fdbd83d4","title":"Potential Dtrack RAT Activity","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"stable","level":"critical","date":"2019-10-30","modified":"2025-11-03","description":"Detects potential Dtrack RAT activity via specific process patterns","references":["https://securelist.com/my-name-is-dtrack/93338/","https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/","https://www.cyberbit.com/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/","https://app.any.run/tasks/4bc9860d-ab51-4077-9e09-59ad346b92fd/","https://app.any.run/tasks/ce4deab5-3263-494f-93e3-afb2b9d79f14/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1490","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/Dtrack-RAT/proc_creation_win_malware_dtrack.yml","techniques":["T1490"],"cves":[]},{"id":"f57f8d16-1f39-4dcb-a604-6c73d9b54b3d","title":"Sensitive File Access Via Volume Shadow Copy Backup","author":"Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)","status":"test","level":"high","date":"2021-08-09","modified":"2024-01-18","description":"Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)\n","references":["https://twitter.com/vxunderground/status/1423336151860002816?s=20","https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection","https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1490"],"path":"rules/windows/process_creation/proc_creation_win_susp_sensitive_file_access_shadowcopy.yml","techniques":["T1490"],"cves":[]},{"id":"facd1549-e416-48e0-b8c4-41d7215eedc8","title":"Amsi.DLL Load By Uncommon Process","author":"frack113","status":"test","level":"low","date":"2023-03-12","modified":"2026-06-29","description":"Detects loading of Amsi.dll by uncommon processes","references":["https://infosecwriteups.com/amsi-bypass-new-way-2023-d506345944e9","https://github.com/TheD1rkMtr/AMSI_patch","https://github.com/surya-dev-singh/AmsiBypass-OpenSession"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.impact","attack.t1490","detection.threat-hunting"],"path":"rules-threat-hunting/windows/image_load/image_load_dll_amsi_uncommon_process.yml","techniques":["T1490"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-21391","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-36884","state":"stale","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}