Background

We looked for a fresh item from the past 48 hours to anchor this guide. A WebSearch on 3 November 2026 returned only general detection engineering explainers and nothing dated 1 or 2 November, so this is an evergreen technique guide. No evidence found as of 3 November 2026 in that search of a new T1490-specific campaign; that reflects the limits of our search, not the threat landscape.

Inhibit System Recovery (T1490) is the step where an operator removes the victim’s ability to roll back: deleting volume shadow copies, wiping backup catalogs, and disabling Windows recovery. It usually runs minutes before encryption or wiping starts, which makes it one of the last high-fidelity alert points in a ransomware chain.

What ATT&CK reports

The MITRE ATT&CK T1490 page (which we opened) shows version 1.6, last modified 12 May 2026. In the procedure examples we read, vssadmin is attributed to families and groups including Conti, Ryuk, Black Basta, Qilin, RansomHub, Royal, Medusa, Babuk, Wizard Spider and the 2025 Poland wiper attacks (C0063). wmic appears for BlackCat, WannaCry and Wizard Spider, and bcdedit for BlackCat, Clop, REvil, Embargo and Olympic Destroyer. This is a single-source summary; we did not open the underlying reports.

The page lists analytic AN0933, which covers process chains using vssadmin, wbadmin, diskshadow, bcdedit, REAgentC or wmic. We read only the summary of that analytic, not its full logic.

Detection 1: shadow copy deletion (Sigma)

Untested. Our own draft, built from commonly documented switches (delete shadows, shadowcopy delete, resize shadowstorage).

title: Shadow Copy Deletion via Native Tools (own draft)
status: experimental
description: Untested. vssadmin, wmic or diskshadow removing or shrinking shadow copies.
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_vss_resize:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'resize'
      - 'shadowstorage'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  selection_diskshadow:
    Image|endswith: '\diskshadow.exe'
    CommandLine|contains: 'delete shadows'
  condition: 1 of selection_*
falsepositives:
  - Backup software maintenance and storage cleanup scripts
  - Administrators reclaiming disk space
level: high
tags:
  - attack.impact
  - attack.t1490

Detection 2: boot recovery and backup catalog tampering (Sigma)

Untested. Covers bcdedit recovery switches and wbadmin catalog deletion.

title: Recovery Disabled via bcdedit or wbadmin (own draft)
status: experimental
description: Untested. Boot recovery disabled or backup catalog deleted.
logsource:
  category: process_creation
  product: windows
detection:
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: 1 of selection_*
falsepositives:
  - Rare; some imaging or lab build scripts
level: high
tags:
  - attack.impact
  - attack.t1490

Detection 3: KQL with parent context

Untested. Written by us and not validated against production data. Expect to allowlist your backup agents.

DeviceProcessEvents
| where Timestamp > ago(14d)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
     or (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("resize", "shadowstorage"))
     or (FileName =~ "wmic.exe" and ProcessCommandLine has_all ("shadowcopy", "delete"))
     or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
     or (FileName =~ "wbadmin.exe" and ProcessCommandLine has_any ("delete catalog", "delete systemstatebackup"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Detection 4: SPL burst of recovery commands

Untested. Several distinct recovery-inhibiting commands on one host in a short window is stronger than any single hit. Assumes Sysmon event ID 1 or Windows 4688 normalised into the Endpoint data model; adjust field names to your environment.

index=endpoint (process_name="vssadmin.exe" OR process_name="wmic.exe" OR process_name="bcdedit.exe" OR process_name="wbadmin.exe")
| eval hit=case(
    like(process,"%delete%shadows%"),"vss_delete",
    like(process,"%resize%shadowstorage%"),"vss_resize",
    like(process,"%shadowcopy%delete%"),"wmic_vss",
    like(process,"%recoveryenabled%no%"),"bcd_recovery",
    like(process,"%delete%catalog%"),"wbadmin_catalog")
| where isnotnull(hit)
| bin _time span=15m
| stats dc(hit) as distinct_techniques values(hit) as hits values(process) as cmds by _time, dest, user
| where distinct_techniques>=2

Our assessment, not sourced: a single vssadmin delete shadows can be benign maintenance, but two or more distinct methods within 15 minutes has few innocent explanations and should page the on-call analyst.

Triage and response

  1. Isolate the host immediately; encryption often follows within minutes.
  2. Identify the parent process and account, and look for earlier staging, credential access and lateral movement from the same account.
  3. Check whether other hosts show the same commands, which suggests scripted or GPO-based deployment by the operator.
  4. Confirm the state of offline and immutable backups before any recovery decision.

Hardening, per the ATT&CK mitigation titles we read (Data Backup, Execution Prevention, Operating System Configuration, User Account Management): keep offline or immutable backups, restrict who can run these utilities, and limit administrative rights. Test any blocking policy in audit mode first.

Sources and gaps

Opened: MITRE ATT&CK T1490 (https://attack.mitre.org/techniques/T1490/). Search attempted: WebSearch for new detection engineering items around 3 November 2026, which returned nothing recent. Not opened: the individual reports behind MITRE’s examples, Microsoft documentation for the utilities, and the full AN0933 analytic. The command switches in our rules come from our own knowledge and were not confirmed in an opened source. No IOCs are given because we have none from a verified source. None of our queries were tested against live telemetry.