T1490Impact

Inhibit System Recovery

Delete shadow copies, disable recovery features.

§ Where this technique fits

T1490 is catalogued under the Impact tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 6 on average.

Authoritative reference: attack.mitre.org/techniques/T1490/.

§ Dossiers chaining this technique

ESXiArgs — OpenSLP unauth RCE → ransomware
Internet-facing ESXi with SLP service on TCP/427 unpatched for CVE-2021-21974. Single ROP gadget chain yields root, then a small bash script encrypts every .vmdk on local datastores.
step 6 / 6

§ Where this technique fits

§ Dossiers chaining this technique

ESXiArgs — OpenSLP unauth RCE → ransomware