Full Report
MITRE ATT&CK Walkthrough: T1490 (Inhibit System Recovery)
Analysis Summary
# Tool/Technique: T1490 - Inhibit System Recovery
## Overview
Inhibit System Recovery is a critical technique used by adversaries to prevent victims from restoring their systems after an attack, primarily ransomware. By deleting volume shadow copies, wiping backup catalogs, and disabling automatic repair features, attackers ensure that the only way to recover data is to fulfill their demands (e.g., paying a ransom). This technique is often the "final step" immediately preceding data encryption.
## Technical Details
- **Type:** Technique (utilizing living-off-the-land binaries)
- **Platform:** Windows
- **Capabilities:** Deletion of backup snapshots, removal of backup catalogs, disabling boot recovery options.
- **First Seen:** Historically used by older variants like WannaCry and Olympic Destroyer; remains a near-universal precursor for modern ransomware.
## MITRE ATT&CK Mapping
- **TA0040 - Impact**
- **T1490 - Inhibit System Recovery**
## Functionality
### Core Capabilities
- **Shadow Copy Deletion:** Wiping all Volume Shadow Copies (VSS) which serve as point-in-time snapshots of the file system.
- **Backup Catalog Destruction:** Deleting the Windows Backup Catalog to prevent restoration from local backups.
- **Boot Configuration Modification:** Altering Boot Configuration Data (BCD) to disable the "recovery enabled" flag, preventing the system from entering automatic repair modes after a crash.
### Advanced Features
- **Silent Operation:** Using flags like `/quiet` or `/all` to ensure the process completes without user intervention or prompts.
- **WMI Integration:** Utilizing `wmic` to programmatically target and delete shadow copies, bypassing direct command-line calls to `vssadmin`.
## Indicators of Compromise
- **File Names:** (Native Binaries)
- `vssadmin.exe`
- `wmic.exe`
- `wbadmin.exe`
- `bcdedit.exe`
- `diskshadow.exe`
- **Behavioral Indicators:**
- `vssadmin.exe delete shadows /all /quiet`
- `wmic shadowcopy delete`
- `wbadmin delete catalog -quiet`
- `bcdedit /set {default} recoveryenabled No`
- `bcdedit /set {default} bootstatuspolicy ignoreallfailures`
## Associated Threat Actors
- **WannaCry** (Lazarus Group)
- **Olympic Destroyer**
- **LockBit**
- **REvil/Sodinokibi**
- **Conti**
## Detection Methods
- **Signature-based detection:** Monitoring for the specific command-line arguments `/all /quiet` combined with `vssadmin` or `wbadmin`.
- **Behavioral detection:**
- Correlating the execution of recovery-disabling tools with prior suspicious activity (e.g., lateral movement or credential theft).
- Alerting on unscoped deletions (deleting *all* shadows) rather than targeted maintenance.
- Monitoring for the sequence of `vssadmin` followed immediately by `bcdedit` and/or `wbadmin`.
- **YARA rules:** Targeting process execution logs that capture the command-line strings mentioned in the Indicators of Compromise.
## Mitigation Strategies
- **Prevention measures:** Implement "Immutable Backups" or "Air-gapped Backups" that cannot be reached or deleted by a compromised administrative account on the production network.
- **Hardening recommendations:**
- Restrict access to native tools like `vssadmin.exe` and `bcdedit.exe` to only authorized service accounts or administrators.
- Utilize the principle of least privilege; ensure regular user accounts cannot invoke shadow copy deletion.
## Related Tools/Techniques
- **T1486 - Data Encrypted for Impact:** Often follows T1490 immediately.
- **T1047 - Windows Management Instrumentation:** Frequently used to execute the deletion commands.
- **T1070 - Indicator Removal on Host:** Related activity to hide the attacker's footprint.