MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Impact/ T1490

T1490Inhibit System Recovery

T1490 — Inhibit System Recovery is a MITRE ATT&CK technique in the Impact tactic. Clankerusecase tracks 22 detection use cases covering it and 4 threat-intel articles citing it.

Impact

View on the matrix → Filter Detection Library MITRE official spec ↗

22Use cases

4Articles

0Sub-techniques

1Tactic

Use cases covering this technique (22)

Azure storage soft-delete disabled Internal actions · alerting DD ASL AWS Disable Bucket Versioning ESCU actions · hunting P AWS Disable Bucket Versioning ESCU actions · hunting P Bcdedit Command Back To Normal Mode Boot ESCU actions · alerting P BCDEdit Failure Recovery Modification ESCU actions · alerting P Change To Safe Mode With Network Config ESCU actions · alerting P Delete ShadowCopy With PowerShell ESCU actions · alerting P Deleting Shadow Copies ESCU actions · alerting P Disabling SystemRestore In Registry ESCU actions · alerting P Prevent Automatic Repair Mode using Bcdedit ESCU actions · alerting P Resize ShadowStorage volume ESCU actions · alerting P WBAdmin Delete System Backups ESCU actions · alerting P Windows BitLocker Suspicious Command Usage ESCU actions · alerting P Windows Cisco Secure Endpoint Related Service Stopped ESCU actions · hunting P Windows Security And Backup Services Stop ESCU actions · alerting P Windows Suspicious File in EFI Volume ESCU actions · alerting P Windows WBAdmin File Recovery From Backup ESCU actions · hunting P Windows WMIC Shadowcopy Delete ESCU actions · hunting P Known Services Killed by Ransomware ESCU actions · alerting P [LLM] DevMan pre-encryption recovery inhibition and event-log clearing Bespoke actions · alerting DSΣPDDCS [LLM] Server-side BitLocker mass encryption enablement (XEntry Team extortion) Bespoke actions · alerting DSΣPDDCS [LLM] The Gentlemen pre-encryption Volume Shadow Copy deletion Bespoke actions · alerting DSΣPDDCS

Articles citing this technique (4)

crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts art-79

high A new extortion cocktail: office printers, small ransoms, and BitLocker art-131

crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-199

crit EDR killers explained: Beyond the drivers art-577