Inhibit System Recovery
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to a...
BY SOURCE
PROCEDURES (34)
Auto-extracted: 4 detections for process creation monitoring
Auto-extracted: 4 detections for azure
Auto-extracted: 4 detections for ransomware
Auto-extracted: 3 detections for aws
Auto-extracted: 2 detections for module load monitoring
Auto-extracted: 2 detections for shadow cop
Auto-extracted: 2 detections for ntds
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for shadow cop
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for cloud
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for registry
Auto-extracted: 2 detections for tamper
Auto-extracted: 2 detections for ransomware
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for file monitoring
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for service