tfMITRE ATT&CK technique

Inhibit System Recovery T1490

Tactic: Impact
Platforms: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version: 1.6
Created: 02 April 2019
Last modified: 12 May 2026
Contributors: Yonatan Gotlib, Deep Instinct; Austin Clark, @c2defense; Pallavi Sivakumaran, WithSecure; Joey Lei; Harjot Shah Singh

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.[1][2] This may deny access to available backups and recovery options.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 23%

Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 8%

Tools & malware92nd percentile · 92% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 6%

Detection rules94th percentile · 94% of ATT&CK techniques have this many detection rules written or fewer.

Inhibit System Recovery MITRE reference T1490

Top 23%of all ATT&CK techniques for number of groups

7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has deleted virtual machines directly from the virtualization platform.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

Storm-0501G1053 ↗

Has deleted snapshots, restore points, storage accounts, and backup services to prevent remediation and restoration.1 Storm-0501 has also impacted Azure resources through the targeting of Microsoft.Compute/snapshots/delete, Microsoft.Compute/restorePointCollections/delete, Microsoft.Storage/storageAccounts/delete, and Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/delete.1

created 2025-10-192 references

Medusa GroupG1051 ↗

Has deleted recovery files such as shadow copies using vssadmin.exe.1 2 3 4

created 2025-10-154 references

BlackByteG1043 ↗

Resized and deleted volume shadow copy files to prevent system recovery after encryption.1 2

created 2024-12-162 referencesaka Hecamede

Scattered SpiderG1015 ↗

Has stopped the Volume Shadow Copy service on compromised hosts.1

created 2023-07-051 referenceaka Roasted 0ktapus

Wizard SpiderG0102 ↗

Has used WMIC and vssadmin to manually delete volume shadow copies. Wizard Spider has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.1

created 2020-05-121 referenceaka UNC1878

All 7 groups for this technique · 6 newest in this preview

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries deleted Windows Volume Shadow Copies using vssadmin delete shadows.1

2025

All 1 campaigns for this technique

48 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

EmbargoS1247 ↗

Has cleared files from the recycle bin by invoking SHEmptyRecycleBinW() and disabled Windows recovery through C:\Windows\System32\cmd.exe /q /c bcdedit /set {default} recoveryenabled no.1

created 2025-10-19MALWAREcarried by 1 group

Medusa RansomwareS1244 ↗

Has deleted recovery files such as shadow copies using vssadmin.exe.1 2 3 4

created 2025-10-17MALWAREcarried by 1 group

QilinS1242 ↗

Can execute vssadmin.exe delete shadows /all /quiet to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.1 2 3 4

created 2025-09-26MALWAREcarried by 2 groups

RansomHubS1212 ↗

Has used vssadmin.exe to delete volume shadow copies.1 2

created 2025-03-17MALWARE

LockBit 3.0S1202 ↗

Can delete volume shadow copies.1 2 3

created 2025-02-05MALWARE

LockBit 2.0S1199 ↗

Has the ability to delete volume shadow copies on targeted hosts.1 2

created 2025-01-24MALWARE

All 48 software entries for this technique · 6 newest in this preview

Offense vs defense T1490

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 27Splunk ESCU (cumulative) · 17

first rule: 2019 Q1 · 1 of 1 campaigns plotted

Inhibit System Recovery detection strategy DET0329

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection for T1490 - Inhibit System Recovery

Enterprise

5 platforms

AN0933 · Windows

Process chains that use native utilities (vssadmin, wbadmin, diskshadow, bcdedit, REAgentC, wmic) with arguments to delete shadow copies, disable recovery, or remove backup catalogs

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File DeletionDC0040	WinEventLog:Microsoft-Windows-Backup	Windows Backup Catalog deletion or catalog corruption
Service MetadataDC0041	WinEventLog:System	Service stopped or RecoveryDisabled set via REAgentC
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Used to track rapid recovery feature changes over short intervals
CommandLinePattern	Can be tuned to catch variations in destructive flags (/all, /quiet, -delete)
ParentProcessContext	Tune based on common parent-child chains (e.g., powershell → diskshadow)

AN0934 · Linux

Shell utilities or scripts deleting /etc/systemd/system/rescue.target, /etc/fstab backups, or /boot/efi partitions; chattr used to block snapshot auto-recovery

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File DeletionDC0040	auditd:CONFIG_CHANGE	/etc/fstab, /etc/systemd/*
Command ExecutionDC0064	auditd:SYSCALL	chattr, rm, shred, dd run on recovery directories or partitions

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WatchedFilePaths	Modify to include specific OS backup configs or LVM snapshots
ShellProcessUser	Restrict detection to root or sudo users

AN0935 · ESXi

ESXi shell or vim-cmd execution that deletes all VM snapshots using vmsvc/snapshot.removeall or rm on snapshot paths

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Snapshot DeletionDC0049	esxi:hostd	snapshot.removeall or snapshot file deletion

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetVMNames	Limit to critical VM names to reduce false positives

AN0936 · Network Devices

Execution of erase, format, and reload in immediate sequence from a privileged AAA session

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:syslog	command sequence: erase → format → reload

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandSequenceWindow	Time between erase and reload command to establish causality
UserPrivilegeLevel	Filter for high-privilege user sessions

AN0937 · IaaS

Cloud API calls disabling snapshot scheduling, backup policies, versioning, followed by DeleteSnapshot/DeleteVolume operations

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Storage DeletionDC0022	AWS:CloudTrail	DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances
Snapshot DeletionDC0049	AWS:CloudTrail	DeleteSnapshot

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserAgent	Tune for legitimate backup automation vs unknown tools
ResourceType	Filter only on production images or vaults

2 analytics

After compromising a network of systems, threat actors often try to delete/resize Shadow Copy in an attempt to prevent administrators from restoring the systems to versions present before the attack. This is often done via vssadmin, a legitimate Windows tool to interact with shadow copies. This action is often employed by ransomware, may lead to a failure in recovering systems after an attack. The pseudo code detection focus on Windows Security and Sysmon process creation (4688 and 1). The use of wmic to delete shadow copy generates WMI-Activity Operationnal 5857 event and could generate 5858 (if the operation fails). These 2 EventIDs could be interesting when attackers use wmic without process creation and/or for forensics.

TypeTTPCoverageLowSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This query looks for the deletion or resizing of shadow copy volumes, which may possibly indicate malicious activity.

((EventCode="4688" OR EventCode="1") (CommandLine="*vssadmin* *delete* *shadows*" OR CommandLine="*wmic* *shadowcopy* *delete*" OR CommandLine="*vssadmin* *resize* *shadowstorage*")) OR (EventCode="5857" ProviderName="MSVSS__PROVIDER") OR (EventCode="5858" Operation="*Win32_ShadowCopy*")

This query looks for the deletion or resizing of shadow copy volumes, which may possibly indicate malicious activity.

(EventCode:("4688" OR "1") AND process.command_line:(*vssadmin*\ *delete*\ *shadows* OR *wmic*\ *shadowcopy*\ *delete* OR *vssadmin*\ *resize*\ *shadowstorage*)) OR (EventCode:"5857" AND ProviderName:"MSVSS__PROVIDER") OR (EventCode:"5858" AND Operation:*Win32_ShadowCopy*)

This query looks for the deletion or resizing of shadow copy volumes, which may possibly indicate malicious activity.

(EventCode IN ["4688", "1"] CommandLine IN ["*vssadmin* *delete* *shadows*", "*wmic* *shadowcopy* *delete*", "*vssadmin* *resize* *shadowstorage*"]) OR (EventCode IN "5857" ProviderName IN "MSVSS__PROVIDER") OR (EventCode IN "5858" Operation IN "*Win32_ShadowCopy*")

Unit tests

CAR’s own validation procedures for this analytic.

Shadow copy deletion with vssadmin

["vssadmin.exe delete shadows /all /quiet"]

Shadow copy deletion with wmic

["wmic shadowcopy delete"]

Shadow copy resize with vssadmin

["vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB"]

This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery.

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Pseudocode implementation of the splunk search below

processes = search Process:Create
bcdedit_commands = filter processes where (
  exe = "C:\Windows\System32\bcdedit.exe" AND command_line="*recoveryenabled*" )
output bcedit_commands

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. Tune based on parent process names.

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user

Unit tests

CAR’s own validation procedures for this analytic.

Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below

["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]

execute the atomic test [T1490](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1490) against a Windows target.

["Invoke-AtomicTest T1490"]

Data BackupM1053

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery. In cloud environments, enable versioning on storage objects where possible, and copy backups to other accounts or regions to isolate them from the original copies. On ESXi servers, ensure that disk images and snapshots of virtual machines are regularly taken, with copies stored off system.

Execution PreventionM1038

Consider using application control configured to block execution of utilities such as diskshadow.exe that may not be required for a given system or network to prevent potential misuse by adversaries.

Operating System ConfigurationM1028

Consider technical controls to prevent the disabling of services or deletion of files involved in system recovery. Additionally, ensure that WinRE is enabled using the following command: reagentc /enable.

User Account ManagementM1018

Limit the user accounts that have access to backups to only those required. In AWS environments, consider using Service Control Policies to restrict API calls to delete backups, snapshots, and images.

Tests13Executorscmd 9 · PowerShell 3 · sh 1Need elevation13 of 13Have prerequisites3Have cleanup5Platformswindows, macos

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Windows - Delete Volume Shadow Copies	windows	cmd	Required	1	—
Deletes Windows Volume Shadow Copies. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon execution, if no shadow volumes exist the message "No items found that satisfy the query." will be displayed. If shadow volumes are present, it will delete them without printing output to the screen. This is because the /quiet parameter was passed which also suppresses the y/n confirmation prompt. Shadow copies can only be created on Windows server or Windows 8. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc788055(v=ws.11) Attack command vssadmin.exe delete shadows /all /quiet Prerequisite Create volume shadow copy of C:\ . This prereq command only works on Windows Server or Windows 8. Check if(!(vssadmin.exe list shadows \| findstr "No items found that satisfy the query.")) { exit 0 } else { exit 1 } Satisfy vssadmin.exe create shadow /for=c: GUID7a2958e9-9dcd-4abf-a6eb-92b0166289f1
02	Windows - Delete Volume Shadow Copies via WMI	windows	cmd	Required	1	—
Deletes Windows Volume Shadow Copies via WMI. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Attack command wmic.exe shadowcopy delete Prerequisite Create volume shadow copy of C:\ . Check if(!(vssadmin.exe list shadows \| findstr "No items found that satisfy the query.")) { exit 0 } else { exit 1 } Satisfy wmic shadowcopy call create Volume='C:\' GUID95872137-b98b-4abf-a145-e4a88430d875
03	Windows - wbadmin Delete Windows Backup Catalog	windows	cmd	Required	—	—
Deletes Windows Backup Catalog. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon execution, "The backup catalog has been successfully deleted." will be displayed in the PowerShell session. Attack command wbadmin delete catalog -quiet GUIDb8434ea4-613b-4d7c-9586-53d38398f87a
04	Windows - Disable Windows Recovery Console Repair	windows	cmd	Required	—	Yes
Disables repair by the Windows Recovery Console on boot. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon execution, "The operation completed successfully." will be displayed in the powershell session. Attack command bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures bcdedit.exe /set {default} recoveryenabled no Cleanup command bcdedit.exe /set {default} bootstatuspolicy DisplayAllFailures >nul 2>&1 bcdedit.exe /set {default} recoveryenabled yes >nul 2>&1 GUID50694141-2fd0-4b5e-8c7e-304364b03b56
05	Windows - Delete Volume Shadow Copies via WMI with PowerShell	windows	PowerShell	Required	—	—
Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil. Executes Get-WMIObject. Shadow copies can only be created on Windows server or Windows 8, so upon execution there may be no output displayed. Attack command Get-WmiObject Win32_Shadowcopy \| ForEach-Object {$_.Delete();} GUIDa1c2f85f-7b86-49f2-bc4e-207ad1bd4c82
06	Windows - Delete Backup Files	windows	cmd	Required	—	—
Deletes backup files in a manner similar to Ryuk ransomware. Upon exection, many "access is denied" messages will appear as the commands try to delete files from around the system. Attack command del /s /f /q c:\.VHD c:\.bac c:\.bak c:\.wbcat c:\.bkf c:\Backup.* c:\backup. c:\.set c:\.win c:\*.dsk GUID06036119-aeec-4232-90a2-8e3950efd62e
07	Windows - wbadmin Delete systemstatebackup	windows	cmd	Required	—	—
Deletes the Windows systemstatebackup using wbadmin.exe. This technique is used by numerous ransomware families. This may only be successful on server platforms that have Windows Backup enabled. Attack command wbadmin delete systemstatebackup -keepVersions:0 GUIDafbc555b-c140-4a09-9a3c-a6574891786f
08	Windows - Disable the SR scheduled task	windows	cmd	Required	—	Yes
Use schtasks.exe to disable the System Restore (SR) scheduled task Attack command schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable Cleanup command schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /enable >nul 2>&1 GUID2682a0e7-f7c0-4c60-bf02-c1a34d8998c5
09	Disable System Restore Through Registry	windows	cmd	Required	—	Yes
Modify the registry of the currently logged in user using reg.exe via cmd console to disable system restore on the computer. See how remcos RAT abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details Attack command reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /t "REG_DWORD" /d "1" /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /t "REG_DWORD" /d "1" /f reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /t "REG_DWORD" /d "1" /f reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /t "REG_DWORD" /d "1" /f Cleanup command reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableConfig" /f >nul 2>&1 reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /f >nul 2>&1 reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /f >nul 2>&1 reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableSR" /f >nul 2>&1 GUID484c02cb-8b48-472d-b082-570919ee19ba
10	Windows - vssadmin Resize Shadowstorage Volume	windows	PowerShell	Required	—	—
Adversaries generally try to Resize Shadowstorage Volume using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event and a precursor to deleting the shadowstorage. Attack command vssadmin resize shadowstorage /For=C: /On=C: /MaxSize=20% GUID4d22521f-a627-4981-b784-216204f2be3d
11	Modify VSS Service Permissions	windows	cmd	Required	—	Yes
This atomic test alters the security settings of the Volume Shadow Copy Service (VSS) by modifying its permissions, potentially impacting system recovery operations. The specific permissions set by the command are as follows: - Deny Generic All (GA) permissions to Network Users (NU) - Deny GA permissions to Everyone (WD) - Deny GA permissions to Anonymous (AN) - Allow Full Access (FA) and Generic All (GA) permissions to Everyone (WD) in System ACL (SACL) - Allow Object Inherit and Inherit Only (OIIO) Full Access (FA) and GA permissions to Everyone (WD) in SACL These permissions can significantly restrict VSS functionalities, including backup and restore operations. As such, it is essential to run this test only in a controlled environment with administrative privileges. A cleanup command is provided to reset VSS permissions to a common default configuration, which should be verified against your specific system's configuration. It's crucial to use this cleanup command after testing to ensure the system's backup and recovery capabilities remain functional. Running this test on a production system or critical environment is not recommended without proper precautions and a robust recovery plan. Attack command sc sdset VSS D:(D;;GA;;;NU)(D;;GA;;;WD)(D;;GA;;;AN)S:(AU;FA;GA;;;WD)(AU;OIIOFA;GA;;;WD) Cleanup command sc sdset VSS D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;LC;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) GUID301e99ba-acb5-44e5-8277-a7ae31d1c369
12	Disable Time Machine	macos	sh	Required	—	Yes
Disables Time Machine which is Apple's automated backup utility software. Attackers can use this to prevent backups from occurring and hinder the victim's ability to recover from any damage. Attack command sudo tmutil disable Cleanup command sudo tmutil enable GUID8eb1d927-20eb-4a0e-92cc-7db8b19f29c6
13	Windows - Delete Volume Shadow Copies via Diskshadow	windows	PowerShell	Required	1	—
Deletes Windows Volume Shadow Copies via Diskshadow binary. This technique is used by numerous ransomware families such as Crytox. The binary is present by default in Windows Server operating systems (since Windows Server 2008). Upon execution, it will delete all shadow copies of the server. Attack command "delete shadows all" \| diskshadow.exe Prerequisite Create volume shadow copy of C:\ . This prereq command only works on Windows Server or Windows 8. Check if(!(vssadmin.exe list shadows \| findstr "No items found that satisfy the query.")) { exit 0 } else { exit 1 } Satisfy vssadmin.exe create shadow /for=c: GUID89d9543c-278a-437e-b035-4aff38666f3d

Tests from Atomic Red Team (MIT licence) · technique definition

Inhibit System Recovery detections T1490

44 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 6%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs