How to Detect Malicious Attempts to Disable Windows System Recovery
Summary
The article explains how to distinguish routine backup management from ransomware preparation that disables Windows recovery, recommending checks of process lineage, deletion scope, related commands and preceding activity.
Key points
- MITRE ATT&CK T1490 covers inhibiting system recovery, including deleting volume shadow copies or disabling recovery options.
- Windows tools such as vssadmin.exe, wmic, wbadmin.exe and bcdedit.exe can perform these actions; their presence alone does not establish malicious activity.
- Routine administration is more likely to be scoped, tied to a known account or schedule, and consistent with documented maintenance.
- Unscoped, quiet deletion—especially alongside recovery-setting changes or backup-catalog deletion—warrants investigation.
- Analysts should trace the process lineage and review preceding activity, such as credential access or lateral movement, rather than assess the command in isolation.
- The article recommends isolating backup infrastructure from credentials and systems an attacker could compromise.
Article Details
- Defense Focus
- Detect malicious inhibition of system recovery by identifying full, silent shadow-copy or backup-catalog deletion in its process and activity context, rather than alerting on the command alone.
- Detection Methods
- Monitor execution of vssadmin, wmic, wbadmin, bcdedit, and diskshadow, then correlate it with process lineage and preceding activity on the endpoint.
- Prioritize full, unscoped deletion such as `vssadmin.exe delete shadows /all /quiet`, especially when paired with recovery-setting changes or backup-catalog deletion within a short timeframe.
- Compare the executing account, command scope, and activity pattern against known backup schedules, maintenance records, and legitimate service-account behavior.
- Investigate backward in the timeline for suspicious LSASS access, WMI-spawned processes, credential theft, or lateral movement; treat missing earlier telemetry as a possible visibility gap.
- Data Sources
- Endpoint process execution and command-line telemetry
- Process ancestry and lineage
- Windows Management Instrumentation (WMI) activity
- Account and service-account context
- Backup schedules, maintenance records, and change tickets
- Shadow-copy, Windows Backup Catalog, and boot-recovery configuration activity
- Earlier endpoint activity and incident timeline
- Rule Types
- Behavioral detection correlating native utility execution, deletion scope, and surrounding activity
- Process-lineage and temporal correlation
- Command-line detection for full, quiet shadow-copy deletion
- Platforms
- Windows
- Defensive Actions
- Investigate full, unscoped shadow-copy deletion paired with recovery changes or backup-catalog deletion.
- Trace the deleting process and its parent lineage; distinguish known, repeatable backup-service activity from suspicious chains.
- Validate the activity against documented schedules, maintenance processes, and authorized accounts.
- Review preceding endpoint activity for signs of credential access or lateral movement, and investigate potential gaps in earlier detection.
- Isolate backup and recovery infrastructure from credentials and systems that could be compromised along the same attack path.
MITRE ATT&CK
T1047 · Windows Management InstrumentationThe `wmic shadowcopy delete` command uses Windows Management Instrumentation to delete shadow copies.T1490 · Inhibit System RecoveryThe article describes deleting volume shadow copies or the Windows Backup Catalog and disabling automatic recovery to remove recovery options before ransomware encryption.
Malware
Olympic Destroyerthis technique shows up as a near-universal precursor across ransomware families, from WannaCry to Olympic Destroyer to a long list of more recent operators. Rarely optional for the attacker, it clears the way forWannaCryfirst. That's why this technique shows up as a near-universal precursor across ransomware families, from WannaCry to Olympic Destroyer to a long list of more recent operators. Rarely optional for the attacker, it
Vendors
Products
Symantec CBXTo see how Symantec CBX and Threat Tracer helps analysts see the full attack chain in seconds, request a 1:1 demo.Threat TracerThis is where Threat Tracer proves it’s worth its salt, even more so than it already has in past techniques. Because this action so rarely happens alone, analysts need to see the full chain that led to it. A shadow copy