// MITRE ATT&CK
T1490 · Inhibit System Recovery
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options. Operating systems ...
How to detect & mitigate it
Detecting Inhibit System Recovery starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1561.002
Disk Structure Wipe T1498.001
Direct Network Flood T1491.002
External Defacement T1499.001
OS Exhaustion Flood T1485.001
Lifecycle-Triggered Deletion T1496.003
SMS Pumping T1499.003
Application Exhaustion Flood T1561
Disk Wipe
Disk Structure Wipe T1498.001
Direct Network Flood T1491.002
External Defacement T1499.001
OS Exhaustion Flood T1485.001
Lifecycle-Triggered Deletion T1496.003
SMS Pumping T1499.003
Application Exhaustion Flood T1561
Disk Wipe
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.