DET0329 Behavioral Detection for T1490 - Inhibit System Recovery

Item	Value
ID	DET0329
Version	1.0
Created	21 October 2025
Last Modified	21 October 2025

Technique Detected: T1490 (Inhibit System Recovery)

Analytics

Windows

AN0933

Process chains that use native utilities (vssadmin, wbadmin, diskshadow, bcdedit, REAgentC, wmic) with arguments to delete shadow copies, disable recovery, or remove backup catalogs

Log Sources

Data Component	Name	Channel
Process Creation (DC0032)	WinEventLog:Sysmon	EventCode=1
File Deletion (DC0040)	WinEventLog:Microsoft-Windows-Backup	Windows Backup Catalog deletion or catalog corruption
Service Metadata (DC0041)	WinEventLog:System	Service stopped or RecoveryDisabled set via REAgentC
Windows Registry Key Modification (DC0063)	WinEventLog:Sysmon	EventCode=13, 14

Mutable Elements

Field	Description
TimeWindow	Used to track rapid recovery feature changes over short intervals
CommandLinePattern	Can be tuned to catch variations in destructive flags (/all, /quiet, -delete)
ParentProcessContext	Tune based on common parent-child chains (e.g., powershell → diskshadow)

Linux

AN0934

Shell utilities or scripts deleting /etc/systemd/system/rescue.target, /etc/fstab backups, or /boot/efi partitions; chattr used to block snapshot auto-recovery

Log Sources

Data Component	Name	Channel
Command Execution (DC0064)	auditd:SYSCALL	chattr, rm, shred, dd run on recovery directories or partitions
File Deletion (DC0040)	auditd:CONFIG_CHANGE	/etc/fstab, /etc/systemd/*

Mutable Elements

Field	Description
WatchedFilePaths	Modify to include specific OS backup configs or LVM snapshots
ShellProcessUser	Restrict detection to root or sudo users

ESXi

AN0935

ESXi shell or vim-cmd execution that deletes all VM snapshots using vmsvc/snapshot.removeall or rm on snapshot paths

Log Sources

Data Component	Name	Channel
Snapshot Deletion (DC0049)	esxi:hostd	snapshot.removeall or snapshot file deletion

Mutable Elements

Field	Description
TargetVMNames	Limit to critical VM names to reduce false positives

Network Devices

AN0936

Execution of erase, format, and reload in immediate sequence from a privileged AAA session

Log Sources

Data Component	Name	Channel
Command Execution (DC0064)	networkdevice:syslog	command sequence: erase → format → reload

Mutable Elements

Field	Description
CommandSequenceWindow	Time between erase and reload command to establish causality
UserPrivilegeLevel	Filter for high-privilege user sessions

IaaS

AN0937

Cloud API calls disabling snapshot scheduling, backup policies, versioning, followed by DeleteSnapshot/DeleteVolume operations

Log Sources

Data Component	Name	Channel
Snapshot Deletion (DC0049)	AWS:CloudTrail	DeleteSnapshot
Cloud Storage Deletion (DC0022)	AWS:CloudTrail	DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances

Mutable Elements

Field	Description
UserAgent	Tune for legitimate backup automation vs unknown tools
ResourceType	Filter only on production images or vaults