How do you detect attempts to inhibit system recovery?

Detect each technique separately and then chain them. Alert on wbadmin delete catalog, systemstatebackup or backup, on Disable-ComputerRestore and System Restore changes, and on shadow copy and boot configuration tampering. Then raise a single high-confidence alert when two or more distinct techniques occur on one host within an hour. Protect the backup plane itself: monitor logons and admin changes on the backup server, forward the backup application’s audit log, separate backup credentials from domain admin credentials and keep an immutable or offline copy.

Detecting Inhibit System Recovery: Backups, Catalogs and Restore Points

Inhibit System Recovery is broader than shadow copies. Operators delete the Windows Backup catalog and system state backups, turn off System Restore, and increasingly target the backup server and repository directly using stolen admin credentials. Each action is detectable, and together they form one of the most reliable pre-encryption chains.

Signals at a Glance

Signal	Where	ATT&CK
wbadmin delete catalog, systemstatebackup or backup	Process creation, Windows Backup log	T1490
Disable-ComputerRestore or System Restore registry changes	PowerShell 4104, registry events	T1490
vssadmin, wmic or diskshadow shadow deletion	Process creation	T1490
Logon to backup server from unusual account or host	Security 4624, backup console logs	T1078
Backup repositories or job configuration deleted or modified	Backup application audit log	T1485

Windows Backup and Restore Points

The wbadmin and System Restore actions are short, rarely legitimate on production hosts, and reliable. This Splunk search covers the process forms; add PowerShell script block logging for the cmdlet forms:

index=wineventlog (sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1)
    OR (sourcetype="WinEventLog:Security" EventCode=4688)
| eval cmd=coalesce(CommandLine, Process_Command_Line)
| where match(cmd, "(?i)wbadmin(\.exe)?\s+delete\s+(catalog|systemstatebackup|backup)")
     OR match(cmd, "(?i)Disable-ComputerRestore")
     OR match(cmd, "(?i)vssadmin(\.exe)?\s+delete\s+shadows")
     OR match(cmd, "(?i)wmic(\.exe)?\s+shadowcopy\s+delete")
| stats count values(cmd) as cmds dc(cmd) as distinct_cmds by host, user, ParentImage
| sort - distinct_cmds
# tune/validate: allowlist your own backup tooling by ParentImage and account.

A second query chains the signals. Two different recovery-inhibition techniques on one host within an hour is far more significant than any one command, and gives you a single high-confidence alert:

index=wineventlog EventCode IN (1, 4688)
| eval cmd=coalesce(CommandLine, Process_Command_Line)
| eval tech=case(
    match(cmd,"(?i)wbadmin.*delete"), "wbadmin",
    match(cmd,"(?i)vssadmin.*delete|shadowcopy.*delete|diskshadow"), "shadow",
    match(cmd,"(?i)bcdedit.*(recoveryenabled|bootstatuspolicy)"), "bcd",
    match(cmd,"(?i)Disable-ComputerRestore|reagentc.*disable"), "restore",
    true(), null())
| where isnotnull(tech)
| bin _time span=1h
| stats dc(tech) as techniques values(tech) as seen by host, _time
| where techniques >= 2
# tune/validate: raise or lower the technique count to match your noise tolerance.

Protect the Backup Plane

Alert on logons to the backup server and console outside the backup team and its jump hosts, and on creation of new backup administrator accounts.
Enable the backup application’s audit log and forward it. Deletion of repositories, jobs or restore points should page someone, with a change record to match.
Keep at least one immutable or offline copy and test restores. Detection helps you contain, but only a good backup helps you recover.
Separate backup credentials from domain admin credentials, so one stolen account does not reach both production and recovery.

Vetted sources

SigmaHQ and Splunk ESCU include wbadmin, System Restore and shadow copy rules, MITRE ATT&CK T1490 documents the technique and the CISA #StopRansomware advisories describe backup targeting. Baseline your own backup software before alerting, since it manages catalogs and restore points routinely.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Windows Backup and Restore Points

Protect the Backup Plane

Build Detections That Fire

Endpoint Ransomware Detection

Detection Hub

Shadow Copy Deletion Detection

Boot Configuration Tamper Detection