T1490Impact
Inhibit System Recovery
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports0
Detections
27 Sigma rules tagged T1490Inhibit System RecoveryT149027 general rules
- Potential Dtrack RAT Activitycriticalstable
- Potential Maze Ransomware Activitycriticaltest
- WannaCry Ransomware Activitycriticaltest
- Boot Configuration Tampering Via Bcdedit.EXEhighstable
- Delete Volume Shadow Copies Via WMI With PowerShellhighstable
- Shadow Copies Deletion Using Operating Systems Utilitieshighstable
- All Backups Deleted Via Wbadmin.EXEhightest
- Copy From VolumeShadowCopy Via Cmd.EXEhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Inhibit System Recovery
2 CVEs, by priority. Each link shows its badge.- CVE-2023-36884Microsoft Windows Search Remote Code Execution VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity99.4%Top 0.06%78.2priority
- CVE-2025-21391Microsoft Windows Storage Link Following VulnerabilityMicrosoft · WindowsKEVHigh · 7.1T1068Exploitation for Privilege EscalationT1485Data Destruction+1 moreMITRE CTID mapping of the KEV entry · primary impact2.3%Top 17%59.6priority