value: Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](T1485) and [Data Encrypted for Impact](T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017)
  
  A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
  
  * `vssadmin.exe` can be used to delete all volume shadow copies on a system - `vssadmin.exe delete shadows /all /quiet`
  * [Windows Management Instrumentation](T1047) can be used to delete volume shadow copies - `wmic shadowcopy delete`
  * `wbadmin.exe` can be used to delete the Windows Backup Catalog - `wbadmin.exe delete catalog -quiet`
  * `bcdedit.exe` can be used to disable automatic Windows recovery features by modifying boot configuration data - `bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no`
name: Inhibit System Recovery