T1490 Inhibit System Recovery

2 threats tracked by Spectrum Delta use this technique.

T1490 on MITRE ATT&CK →

• n0n credential extortion

  Shadow copies deleted before encryption

  Sysmon process-creation events (vssadmin.exe delete shadows; CYFIRMA's hunt targets the same commands via Windows process creation (CYFIRMA, B/3))

  Seen in: Sysmon

• Majinahanashi ransomware

  Inhibit system recovery: seven utilities, ten commands, run twice, ~14 seconds

  Sysmon EventID 1 process-creation events with the ransomware binary as direct parent of vssadmin/bcdedit/reagentc/powercfg/wevtutil/fsutil (no cmd.exe intermediate); Windows EventID 1102 (Security-log clearing) from the wevtutil pass; the burst-twice timing pattern

  Seen in: Windows EDR / Sysmon process+file, Windows Event Log