T1490
Inhibit System Recovery
Containers · ESXi · IaaS · Linux · macOS · Network Devices · Windows9 pieces on this siteT1490 on attack.mitre.org
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Ransomware response plan: from the first renamed file to the review
The whole response rather than the first hour of it: who decides what, how to contain without destroying the evidence you will need, what has to be true before you restore, and the notifications whose clocks started before you noticed.
First 15 minutes: a ransom note, or files that suddenly will not open
Encryption is under way or has just finished. Contain without destroying the memory that holds the operator's tools, protect the backups, and start the clocks that legal and your insurer will ask about.
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma endpoint pack: seven rules for the Windows techniques that keep working
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Volume Shadow Copies
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Somebody disabled the antivirus on eleven servers
You have minutes rather than hours. Say what you do first, and what you deliberately do not do.
Read
Analyses, case studies, guides, references and interview questions.
False-Positive Hall of Fame No. 1: six alerts that were the software working
Chrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.
The detection that was switched off in March
Issue one. A control that existed and had been disabled nine weeks earlier, a signup flow that failed silently for anyone behind a VPN, and the retention number that decides whether any of the rest matters.
Incident report: Kesterline Components, 8 May 2026
A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.
how MITRE says to see it
Behavioral Detection for T1490 - Inhibit System Recovery
- Process chains that use native utilities (vssadmin, wbadmin, diskshadow, bcdedit, REAgentC, wmic) with arguments to delete shadow copies, disable recovery, or remove backup catalogs
- Shell utilities or scripts deleting `/etc/systemd/system/rescue.target`, `/etc/fstab` backups, or `/boot/efi` partitions; chattr used to block snapshot auto-recovery
- ESXi shell or vim-cmd execution that deletes all VM snapshots using vmsvc/snapshot.removeall or rm on snapshot paths
- Execution of `erase`, `format`, and `reload` in immediate sequence from a privileged AAA session
what reduces it
- M1028 Operating System Configuration. Consider technical controls to prevent the disabling of services or deletion of files involved in system recovery. Additionally, ensure that WinRE is enabled using the following command: `reagentc /enable`.
- M1053 Data Backup. Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.
- M1038 Execution Prevention. Consider using application control configured to block execution of utilities such as `diskshadow.exe` that may not be required for a given system or network to prevent potential misuse by adversaries.
- M1018 User Account Management. Limit the user accounts that have access to backups to only those required. In AWS environments, consider using Service Control Policies to restrict API calls to delete backups, snapshots, and images.