THREATNOIR
Subscribe
MITRE ATT&CK · T1490

Inhibit System Recovery

MITRE · cited in 6 of our lessons

Explanation

What attackers do. Attackers delete backups, shadow copies and recovery settings, or disable recovery services, so victims cannot restore systems without paying. This is a standard ransomware step and serves the Impact tactic.

How to defend. Keep backups offline or immutable and separate from the main domain and its credentials. Restrict and monitor the use of tools that manage shadow copies, boot configuration and backup catalogues. Endpoint protection can block known commands used to delete recovery data. Alert on these actions with high priority, as they usually come shortly before encryption starts.

Signs to look for. Look for deletion of shadow copies, changes to boot recovery settings, backup jobs being deleted or disabled and backup console logins from unusual hosts. A common gap is discovering backups were wiped only when a restore is attempted.

Open the technique on MITRE ATT&CK
The official text
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact. Furthermore, adversaries may disable recovery notifications, then corrupt backups. A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.