T1490 — Inhibit System Recovery

Tactic: Impact · Platforms: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a…

Sigma detection rules (5)

T1490 Inhibit System Recovery

title: T1490 Inhibit System Recovery
id: a99731eb-ce7e-4c5a-957c-e5c679ac47d7
description: 'Behavioral Detection for T1490 - Inhibit System Recovery via command-line tools (vssadmin, wbadmin, bcdedit, wmic shadowcopy) used to delete shadow copies, backup catalogs, or disable automatic repair. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, CommandLinePattern, ParentProcessContext.'
references:
  - https://attack.mitre.org/techniques/T1490
author: Shahrukh Khan
date: 2026-04-15
license: MIT
tags:
  - attack.impact
  - attack.t1490

logsource:
  category: process_creation
  product: windows

detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadow'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete backup'
      - 'delete systemstatebackup'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains|all:
      - 'recoveryenabled'
      - 'no'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: 1 of selection_* and not filter_system_account

falsepositives:
  - Legitimate backup rotation scripts, disk-space cleanup utilities, or approved BCD maintenance; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1490 Inhibit System Recovery

title: T1490 Inhibit System Recovery
id: da304900-6f62-40b5-89f5-eae0141ea369
description: 'Behavioral Detection for T1490 - Inhibit System Recovery on Linux. The previous rule conflated Windows Volume Shadow Copy terminology with the unrelated /etc/shadow password file (rm targeting "shadow" is a credential-access/impact event, not recovery inhibition) and unnecessarily scoped legitimate LVM cleanup to /tmp-launched executables. This version instead detects actual Linux backup/recovery-inhibition primitives: LVM/btrfs/zfs snapshot removal and prune/delete/forget operations against snapshot-and-backup tools (timeshift, restic, borg, snapper). Tune using: WatchedFilePaths, ShellProcessUser.'
references:
  - https://attack.mitre.org/techniques/T1490
author: Shahrukh Khan
date: 2026-04-08
license: MIT
tags:
  - attack.impact
  - attack.t1490

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_lvm:
    type: EXECVE
    a0|endswith:
      - '/vgremove'
      - '/lvremove'
  selection_btrfs:
    type: EXECVE
    a0|endswith: '/btrfs'
    a1|contains: 'subvolume'
    a2|contains: 'delete'
  selection_zfs:
    type: EXECVE
    a0|endswith: '/zfs'
    a1|contains: 'destroy'
  selection_backup_tools:
    type: EXECVE
    a0|endswith:
      - '/timeshift'
      - '/restic'
      - '/borg'
      - '/snapper'
    a1|contains:
      - 'delete'
      - 'prune'
      - 'forget'

  condition: 1 of selection_*

falsepositives:
  - Legitimate storage/backup-retention maintenance by an authorized administrator (LVM cleanup during decommissioning, scheduled backup pruning per a retention policy); scope WatchedFilePaths to backup-specific volume/repo names and ShellProcessUser to unexpected accounts.

level: critical

T1490 Inhibit System Recovery

title: T1490 Inhibit System Recovery
id: c844b554-aabb-4eb4-b074-d37d099c2719
description: 'Behavioral Detection for T1490 - Inhibit System Recovery. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserAgent, ResourceType.'
references:
  - https://attack.mitre.org/techniques/T1490
author: Shahrukh Khan
date: 2026-06-03
license: MIT
tags:
  - attack.impact
  - attack.t1490

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource:
      - 'ec2.amazonaws.com'
      - 'rds.amazonaws.com'
    eventName:
      - 'DeleteSnapshot'
      - 'DeleteDBSnapshot'
      - 'DeleteDBClusterSnapshot'
      - 'DisableEbsEncryptionByDefault'

  condition: selection

falsepositives:
  - Automated snapshot lifecycle management legitimately deletes aged snapshots on a schedule, so correlate deletion volume and timing against the known backup retention policy before escalating.

level: high

T1490 Inhibit System Recovery

title: T1490 Inhibit System Recovery
id: a030ebe9-d86a-47be-a41d-c1c21c44a412
description: 'Behavioral Detection for T1490 - Inhibit System Recovery. (Data Component: Command Execution; baseline tier: fallback.) Fixed: vgremove/lvremove are now matched on binary name alone since volume/logical-volume removal is their inherent function and they do not take a delete argument; timeshift keeps the delete-argument requirement since only "timeshift --delete" destroys a snapshot. Tune using: CommandSequenceWindow, UserPrivilegeLevel.'
references:
  - https://attack.mitre.org/techniques/T1490
author: Shahrukh Khan
date: 2026-03-25
modified: 2026-07-26
license: MIT
tags:
  - attack.impact
  - attack.t1490

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_rm:
    type: EXECVE
    a0|endswith: '/rm'
    a1|contains:
      - '/var/backups'
      - '/snapshot'
  selection_lvm:
    type: EXECVE
    a0|endswith:
      - '/vgremove'
      - '/lvremove'
  selection_timeshift:
    type: EXECVE
    a0|endswith: '/timeshift'
    a1|contains: 'delete'

  condition: 1 of selection_*

falsepositives:
  - Legitimate backup retention policies and storage cleanup jobs also remove old backup archives or snapshot files under /var/backups or /snapshot.
  - Routine LVM maintenance (decommissioning a volume group or logical volume, reclaiming space) also invokes vgremove/lvremove; scope to hosts outside expected storage-maintenance windows for higher confidence.
  - Administrator-initiated timeshift snapshot rotation via --delete is expected on systems that use timeshift for scheduled snapshot cleanup.

level: critical

T1490 Inhibit System Recovery

title: T1490 Inhibit System Recovery
id: e13f4018-aaa8-48e2-b816-301b8e3d6f30
description: 'Behavioral Detection for T1490 - Inhibit System Recovery. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TargetVMNames.'
references:
  - https://attack.mitre.org/techniques/T1490
author: Shahrukh Khan
date: 2026-03-03
license: MIT
tags:
  - attack.impact
  - attack.t1490

logsource:
  product: esxi
  service: hostd

detection:
  selection_task:
    Message|contains:
      - 'RemoveSnapshot'
      - 'RemoveAllSnapshots'
      - 'ConsolidateVMDisk'
  selection_cli:
    Message|contains: 'vim-cmd vmsvc/snapshot.removeall'

  condition: 1 of selection_*

falsepositives:
  - Routine snapshot cleanup performed by backup software or administrators after a completed backup job against TargetVMNames that are part of a normal backup rotation.

level: high

Explore