Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version
1.6
Created
02 April 2019
Last modified
12 May 2026
Contributors
Yonatan Gotlib, Deep Instinct; Austin Clark, @c2defense; Pallavi Sivakumaran, WithSecure; Joey Lei; Harjot Shah Singh
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.[1][2] This may deny access to available backups and recovery options.
Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact.[3][4] Furthermore, adversaries may disable recovery notifications, then corrupt backups.[5]
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet
* Windows Management Instrumentation can be used to delete volume shadow copies - wmic shadowcopy delete
* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet
* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system
* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all[6][7]
On network devices, adversaries may leverage Disk Wipe to delete backup firmware images and reformat the file system, then System Shutdown/Reboot to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.
On ESXi servers, adversaries may delete or encrypt snapshots of virtual machines to support Data Encrypted for Impact, preventing them from being leveraged as backups (e.g., via vim-cmd vmsvc/snapshot.removeall).[8]
Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services.[9] In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.[10][11]
Top 23%of all ATT&CK techniques for number of groups
7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has deleted snapshots, restore points, storage accounts, and backup services to prevent remediation and restoration.1Storm-0501 has also impacted Azure resources through the targeting of Microsoft.Compute/snapshots/delete,
Microsoft.Compute/restorePointCollections/delete,
Microsoft.Storage/storageAccounts/delete, and
Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/delete.1
Has used WMIC and vssadmin to manually delete volume shadow copies. Wizard Spider has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.1
created 2020-05-121 referenceaka UNC1878
All 7 groups for this technique · 6 newest in this preview
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
During the 2025 Poland Wiper Attacks, the adversaries deleted Windows Volume Shadow Copies using vssadmin delete shadows.1
2025
All 1 campaigns for this technique
48 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has cleared files from the recycle bin by invoking SHEmptyRecycleBinW() and disabled Windows recovery through C:\Windows\System32\cmd.exe /q /c bcdedit /set {default} recoveryenabled no.1
Can execute vssadmin.exe delete shadows /all /quiet to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.1234
Inhibit System Recovery detection strategy DET0329
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection for T1490 - Inhibit System Recovery
Enterprise
5 platforms
AN0933 · Windows
Process chains that use native utilities (vssadmin, wbadmin, diskshadow, bcdedit, REAgentC, wmic) with arguments to delete shadow copies, disable recovery, or remove backup catalogs
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
TimeWindow
Used to track rapid recovery feature changes over short intervals
CommandLinePattern
Can be tuned to catch variations in destructive flags (/all, /quiet, -delete)
ParentProcessContext
Tune based on common parent-child chains (e.g., powershell → diskshadow)
AN0934 · Linux
Shell utilities or scripts deleting /etc/systemd/system/rescue.target, /etc/fstab backups, or /boot/efi partitions; chattr used to block snapshot auto-recovery
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
UserAgent
Tune for legitimate backup automation vs unknown tools
ResourceType
Filter only on production images or vaults
2 analytics
After compromising a network of systems, threat actors often try to delete/resize Shadow Copy in an attempt to prevent administrators from restoring the systems to versions present before the attack. This is often done via vssadmin, a legitimate Windows tool to interact with shadow copies. This action is often employed by ransomware, may lead to a failure in recovering systems after an attack. The pseudo code detection focus on Windows Security and Sysmon process creation (4688 and 1). The use of wmic to delete shadow copy generates WMI-Activity Operationnal 5857 event and could generate 5858 (if the operation fails). These 2 EventIDs could be interesting when attackers use wmic without process creation and/or for forensics.
TypeTTPCoverageLowSubmitted2020
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This query looks for the deletion or resizing of shadow copy volumes, which may possibly indicate malicious activity.
((EventCode="4688" OR EventCode="1") (CommandLine="*vssadmin* *delete* *shadows*" OR CommandLine="*wmic* *shadowcopy* *delete*" OR CommandLine="*vssadmin* *resize* *shadowstorage*")) OR (EventCode="5857" ProviderName="MSVSS__PROVIDER") OR (EventCode="5858" Operation="*Win32_ShadowCopy*")
This query looks for the deletion or resizing of shadow copy volumes, which may possibly indicate malicious activity.
(EventCode:("4688" OR "1") AND process.command_line:(*vssadmin*\ *delete*\ *shadows* OR *wmic*\ *shadowcopy*\ *delete* OR *vssadmin*\ *resize*\ *shadowstorage*)) OR (EventCode:"5857" AND ProviderName:"MSVSS__PROVIDER") OR (EventCode:"5858" AND Operation:*Win32_ShadowCopy*)
This query looks for the deletion or resizing of shadow copy volumes, which may possibly indicate malicious activity.
(EventCode IN ["4688", "1"] CommandLine IN ["*vssadmin* *delete* *shadows*", "*wmic* *shadowcopy* *delete*", "*vssadmin* *resize* *shadowstorage*"]) OR (EventCode IN "5857" ProviderName IN "MSVSS__PROVIDER") OR (EventCode IN "5858" Operation IN "*Win32_ShadowCopy*")
Unit tests
CAR’s own validation procedures for this analytic.
This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery.
TypeTTPCoverageModerateSubmitted2021
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Pseudocode implementation of the splunk search below
processes = search Process:Create
bcdedit_commands = filter processes where (
exe = "C:\Windows\System32\bcdedit.exe" AND command_line="*recoveryenabled*" )
output bcedit_commands
You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. Tune based on parent process names.
| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user
Unit tests
CAR’s own validation procedures for this analytic.
Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below
Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data. Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery. In cloud environments, enable versioning on storage objects where possible, and copy backups to other accounts or regions to isolate them from the original copies. On ESXi servers, ensure that disk images and snapshots of virtual machines are regularly taken, with copies stored off system.
Consider using application control configured to block execution of utilities such as diskshadow.exe that may not be required for a given system or network to prevent potential misuse by adversaries.
Consider technical controls to prevent the disabling of services or deletion of files involved in system recovery. Additionally, ensure that WinRE is enabled using the following command: reagentc /enable.
Limit the user accounts that have access to backups to only those required. In AWS environments, consider using Service Control Policies to restrict API calls to delete backups, snapshots, and images.
Tests13Executorscommand_prompt 9 · powershell 3 · sh 1Need elevation13 of 13Have prerequisites3Have cleanup5Platformswindows, macos
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Windows - Delete Volume Shadow Copies
windows
command_prompt
Required
1
—
Deletes Windows Volume Shadow Copies. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon
execution, if no shadow volumes exist the message "No items found that satisfy the query." will be displayed. If shadow volumes are present, it
will delete them without printing output to the screen. This is because the /quiet parameter was passed which also suppresses the y/n
confirmation prompt. Shadow copies can only be created on Windows server or Windows 8.
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc788055(v=ws.11)
Attack Commandsrun with command_promptelevation required (root or admin)
vssadmin.exe delete shadows /all /quiet
Dependenciesrun with powershell
Description
Create volume shadow copy of C:\ . This prereq command only works on Windows Server or Windows 8.
Check Prereq Commands
if(!(vssadmin.exe list shadows | findstr "No items found that satisfy the query.")) { exit 0 } else { exit 1 }
Get Prereq Commands
vssadmin.exe create shadow /for=c:
GUID43819286-91a9-4369-90ed-d31fb4da2c01
02
Windows - Delete Volume Shadow Copies via WMI
windows
command_prompt
Required
2
—
Deletes Windows Volume Shadow Copies via WMI. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.
Attack Commandsrun with command_promptelevation required (root or admin)
wmic.exe shadowcopy delete
Dependenciesrun with powershell
Description
WMIC must be installed (deprecated and removed by default in Windows 11 22H2+)
if(!(vssadmin.exe list shadows | findstr "No items found that satisfy the query.")) { exit 0 } else { exit 1 }
Get Prereq Commands
wmic shadowcopy call create Volume='C:\'
GUID6a3ff8dd-f49c-4272-a658-11c2fe58bd88
03
Windows - wbadmin Delete Windows Backup Catalog
windows
command_prompt
Required
—
—
Deletes Windows Backup Catalog. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer. Upon execution,
"The backup catalog has been successfully deleted." will be displayed in the PowerShell session.
Attack Commandsrun with command_promptelevation required (root or admin)
wbadmin delete catalog -quiet
GUID263ba6cb-ea2b-41c9-9d4e-b652dadd002c
04
Windows - Disable Windows Recovery Console Repair
windows
command_prompt
Required
—
Yes
Disables repair by the Windows Recovery Console on boot. This technique is used by numerous ransomware families and APT malware such as Olympic Destroyer.
Upon execution, "The operation completed successfully." will be displayed in the powershell session.
Attack Commandsrun with command_promptelevation required (root or admin)
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
bcdedit.exe /set {default} recoveryenabled no
Windows - Delete Volume Shadow Copies via WMI with PowerShell
windows
powershell
Required
—
—
Deletes Windows Volume Shadow Copies with PowerShell code and Get-WMIObject.
This technique is used by numerous ransomware families such as Sodinokibi/REvil.
Executes Get-WMIObject. Shadow copies can only be created on Windows server or Windows 8, so upon execution
there may be no output displayed.
Attack Commandsrun with powershellelevation required (root or admin)
Deletes backup files in a manner similar to Ryuk ransomware. Upon exection, many "access is denied" messages will appear as the commands try
to delete files from around the system.
Attack Commandsrun with command_promptelevation required (root or admin)
Deletes the Windows systemstatebackup using wbadmin.exe. This technique is used by numerous ransomware families. This may only be successful on server platforms that have Windows Backup enabled.
Attack Commandsrun with command_promptelevation required (root or admin)
wbadmin delete systemstatebackup -keepVersions:0
GUID584331dd-75bc-4c02-9e0b-17f5fd81c748
08
Windows - Disable the SR scheduled task
windows
command_prompt
Required
—
Yes
Use schtasks.exe to disable the System Restore (SR) scheduled task
Attack Commandsrun with command_promptelevation required (root or admin)
Modify the registry of the currently logged in user using reg.exe via cmd console to disable system restore on the computer.
See how remcos RAT abuses this technique- https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details
Attack Commandsrun with command_promptelevation required (root or admin)
Adversaries generally try to Resize Shadowstorage Volume using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event and a precursor to deleting the shadowstorage.
Attack Commandsrun with powershellelevation required (root or admin)
This atomic test alters the security settings of the Volume Shadow Copy Service (VSS) by modifying its permissions, potentially impacting system recovery operations. The specific permissions set by the command are as follows:
- Deny Generic All (GA) permissions to Network Users (NU)
- Deny GA permissions to Everyone (WD)
- Deny GA permissions to Anonymous (AN)
- Allow Full Access (FA) and Generic All (GA) permissions to Everyone (WD) in System ACL (SACL)
- Allow Object Inherit and Inherit Only (OIIO) Full Access (FA) and GA permissions to Everyone (WD) in SACL
These permissions can significantly restrict VSS functionalities, including backup and restore operations. As such, it is essential to run this test only in a controlled environment with administrative privileges.
A cleanup command is provided to reset VSS permissions to a common default configuration, which should be verified against your specific system's configuration. It's crucial to use this cleanup command after testing to ensure the system's backup and recovery capabilities remain functional. Running this test on a production system or critical environment is not recommended without proper precautions and a robust recovery plan.
Attack Commandsrun with command_promptelevation required (root or admin)
Disables Time Machine which is Apple's automated backup utility software. Attackers can use this to prevent backups from occurring and hinder the victim's ability to recover from any damage.
Attack Commandsrun with shelevation required (root or admin)
sudo tmutil disable
Cleanup Commands
sudo tmutil enable
GUIDed952f70-91d4-445a-b7ff-30966bfb1aff
13
Windows - Delete Volume Shadow Copies via Diskshadow
windows
powershell
Required
1
—
Deletes Windows Volume Shadow Copies via Diskshadow binary. This technique is used by numerous ransomware families such as Crytox. The binary is present by default in Windows Server operating systems (since Windows Server 2008). Upon execution, it will delete all shadow copies of the server.
Attack Commandsrun with powershellelevation required (root or admin)
"delete shadows all" | diskshadow.exe
Dependenciesrun with powershell
Description
Create volume shadow copy of C:\ . This prereq command only works on Windows Server or Windows 8.
Check Prereq Commands
if(!(vssadmin.exe list shadows | findstr "No items found that satisfy the query.")) { exit 0 } else { exit 1 }
The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". (...)
The following analytic identifies the resizing of shadow storage volumes, a technique used by ransomware like CLOP to prevent the recreation of shadow volumes. (...)
Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
2019-01-16
2025-10-18
41d40bff-377a-43e2-8e1b-2e543069e079
Splunk
The following analytic detects the execution of wbadmin.exe with flags that delete backup files, specifically targeting catalog or system state backups. (...)
This analytic detects the use of WMIC to delete volume shadow copies, which is a common technique used by ransomware actors to prevent system recovery. (...)