MITRE ATT&CKtechnique

T1490 Inhibit System Recovery

Published 2019-04-02 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Impact
Platforms
Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version
1.6
Created
2019-04-02

Description

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact. Furthermore, adversaries may disable recovery notifications, then corrupt backups. A number of native Windows utilities have been used by adversaries to disable or delete system recovery features: • vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet • Windows Management Instrumentation can be used to delete volume shadow copies - wmic shadowcopy delete • wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet • bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no • REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system • diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all On network devices, adversaries may leverage Disk Wipe to delete backup firmware images and reformat the file system, then System Shutdown/Reboot to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations. On ESXi servers, adversaries may delete or encrypt snapshots of virtual machines to support Data Encrypted for Impact, preventing them from being leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot.removeall`). Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services. In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1053 Data Backup mitigation
  • M1038 Execution Prevention mitigation
  • M1018 User Account Management mitigation
  • M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · uses (57)

  • S9051 The Gentlemen Ransomware software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • G1055 VOID MANTICORE group
  • G1053 Storm-0501 group
  • S1247 Embargo software (malware)
  • S1244 Medusa Ransomware software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1212 RansomHub software (malware)
  • S1202 LockBit 3.0 software (malware)
  • S1199 LockBit 2.0 software (malware)
  • S1180 BlackByte Ransomware software (malware)
  • S1181 BlackByte 2.0 Ransomware software (malware)
  • G1043 BlackByte group
  • S1162 Playcrypt software (malware)
  • S1150 ROADSWEEP software (malware)
  • S1139 INC Ransomware software (malware)
  • S1135 MultiLayer Wiper software (malware)
  • S1136 BFG Agonizer software (malware)
  • S1129 Akira software (malware)
  • S1111 DarkGate software (malware)
  • G1015 Scattered Spider group
  • S1073 Royal software (malware)
  • S1070 Black Basta software (malware)
  • S1068 BlackCat software (malware)
  • S1058 Prestige software (malware)
  • S0697 HermeticWiper software (malware)
  • S0688 Meteor software (malware)
  • S0673 DarkWatchman software (malware)
  • S0659 Diavol software (malware)
Show all 57 ›

Referenced by Compliance · mitigates (17)

  • CIS-11.2 Perform Automated Backups CIS Safeguard v8.1
  • CIS-11.3 Protect Recovery Data CIS Safeguard v8.1
  • CIS-11.4 Establish and Maintain an Isolated Instance of Recovery Data CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CP-10 System Recovery and Reconstitution NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-CP-7 Alternate Processing Site NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References