T1490 Inhibit System Recovery — Detection & Response
Adversaries may delete or remove built-in data and disable services designed to aid in the recovery of a corrupted system to prevent recovery. This includes deleting Volume Shadow Copies, disabling Windows Recovery Console, tampering with backup agents, and modifying boot configurations — techniques used to maximise damage and hinder recovery after a destructive attack or ransomware deployment.
Coverage at a glance
- Detections shipped
- 4
- Avg. verdict time
- < 5 min
- Data sources
- 2+
Threat context
How adversaries use T1490 Inhibit System Recovery — Detection & Response
Adversaries may delete or remove built-in data and disable services designed to aid in the recovery of a corrupted system to prevent recovery. This includes deleting Volume Shadow Copies, disabling Windows Recovery Console, tampering with backup agents, and modifying boot configurations — techniques used to maximise damage and hinder recovery after a destructive attack or ransomware deployment.
Inhibiting system recovery is a standard step in pre-ransomware playbooks and destructive attack campaigns. After gaining sufficient privilege, attackers run commands to delete Volume Shadow Copies (vssadmin delete shadows /all), disable Windows recovery (bcdedit /set {default} recoveryenabled No), and terminate backup agent processes. These actions typically occur in a burst of activity 5–15 minutes before encryption begins, making this technique a critical early warning indicator that ManySignal is tuned to catch.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| vssadmin Delete Shadows Command Execution 'vssadmin delete shadows /all' or '/quiet' variant executed — the most common Shadow Copy deletion method in ransomware pre-encryption. | Critical | CrowdStrike / Windows Event Log |
| bcdedit Recovery Mode Disabled bcdedit.exe command setting recoveryenabled to 'No' — disables Windows Recovery Environment access from the boot menu. | High | CrowdStrike / Windows Event Log |
| Windows Backup Service Stopped and Disabled The Windows Server Backup (wbengine) or Volume Shadow Copy service is stopped and configured for disabled startup by a non-admin account. | High | CrowdStrike / Windows Event Log |
| wmic shadowcopy delete Execution WMIC command used to delete all shadow copies — functionally equivalent to vssadmin but used to evade process-name-based detection. | Critical | CrowdStrike / SentinelOne |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1490 Inhibit System Recovery — Detection & Response: frequently asked questions
Is vssadmin deletion alone enough to trigger a ManySignal alert?
Yes. Any execution of vssadmin with shadow deletion parameters triggers a Critical severity alert in ManySignal, regardless of other context. This command has no legitimate use outside very specific disaster recovery scenarios that should be pre-approved and scheduled.
How does this relate to the broader ransomware playbook?
T1490 (Inhibit System Recovery) is typically the penultimate step before T1486 (Data Encrypted for Impact). Detecting T1490 gives responders 5–15 minutes to act before encryption begins at scale. ManySignal's automated response can trigger endpoint isolation the moment T1490 commands are detected.
Does this technique apply to Linux and macOS systems?
Yes. Linux equivalents include deleting snapshot files, disabling systemd backup services, and overwriting block devices. macOS targets Time Machine volumes. ManySignal has detection rules for cross-platform T1490 variants.
Can ManySignal detect cloud backup tampering?
Yes. AWS Backup and Azure Backup modification events are ingested via CloudTrail and Azure Activity Logs. Deletion of backup vaults, recovery points, or disabling backup policies are treated as high-severity impact preparation events.
What is the fastest possible response to a T1490 detection?
ManySignal can trigger automated isolation of the affected endpoint via CrowdStrike or SentinelOne network containment within seconds of detection. This stops the attacker from reaching additional systems while investigation proceeds.
Does the PowerShell 'Get-WmiObject Win32_ShadowCopy | Remove-WmiObject' pattern get detected?
Yes. ManySignal detects PowerShell Shadow Copy deletion commands including WMI-based variants, not just vssadmin. Detection rules cover common obfuscation patterns used to evade name-based detection.
Do backup vendors typically alert on Shadow Copy deletion?
Backup agents may lose connectivity when VSS is deleted, but this is often mistaken for a connectivity issue rather than an attack. ManySignal provides the attack context that transforms a backup agent error into a ransomware precursor alert.
What is the difference between T1490 and T1561 (Disk Wipe)?
T1490 disables recovery mechanisms (backup, VSS, boot recovery) to prevent remediation. T1561 directly overwrites disk data. T1490 is typically a pre-condition of T1486 ransomware; T1561 is used in destructive wiper attacks. Both are Impact techniques.
How should incident responders prioritise when T1490 fires?
Treat it as a potential imminent ransomware event. Immediately: 1) Identify the executing user and process parent chain. 2) Check for other IOCs (lateral movement, credential access). 3) Isolate the host. 4) Assess if additional hosts show the same commands. Time from T1490 to encryption is typically minutes.
Does ManySignal integrate with backup platforms for recovery orchestration?
ManySignal does not manage backup restoration, but it integrates with ITSM platforms (ServiceNow, Jira) to automatically create recovery tickets with full attack context when T1490 is detected, accelerating the recovery coordination process.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.