Inhibit System Recovery detection rulesT1490

Detects potential Dtrack RAT activity via specific process patterns

windows · process_creation

Detects specific process characteristics of Maze ransomware word document droppers

windows · process_creation

Detects WannaCry ransomware activity

windows · process_creation

Detects the deletion of all backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

windows · process_creation

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

windows · process_creation

Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)

windows · process_creation

Shadow Copies deletion using operating systems utilities via PowerShell

windows · ps_classic_start

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

windows · process_creation

Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

windows · ps_script

Detects the modification of the registry to disable a system restore on the computer

windows · registry_set

Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)

windows · process_creation

Shadow Copies deletion using operating systems utilities

windows · process_creation

Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.

windows · image_load

Detects the image load of VSS DLL by uncommon executables

windows · image_load

Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.

windows · process_creation

Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.

aws

Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

windows · file_delete

Modifications to a config that will serve an adversary's impacts or persistence

cisco

Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.

windows · process_creation

Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

macos · process_creation

Detects the addition of new root, CA or AuthRoot certificates to the Windows registry

windows · registry_set

Detects the image load of VSS DLL by uncommon executables

windows · image_load

Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.

macos · process_creation

Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.

macos · process_creation

Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled.

windows · process_creation

Detects attempts to disable windows recovery environment using Reagentc. ReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE). It allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.

windows · process_creation

Detects loading of Amsi.dll by uncommon processes

windows · image_load