Multiple System Recovery Inhibition Commands

Ethan Andrews@eandrews

•updated Feb 27, 2026•2•0•31

This rule detects the execution of multiple distinct commands used to inhibit system recovery on a single host within a short time window. This behavior is a strong indicator of ransomware or other destructive malware attempting to prevent system restoration.