VILE Ransomware System Recovery Inhibition via wbadmin and bcdedit
Detects the execution of Windows native utilities wbadmin and bcdedit configured to inhibit system recovery, a common behavior observed in ransomware campaigns to prevent data restoration. Specifically, it monitors for the deletion of the Windows Backup catalog and the modification of boot configuration to ignore failure states.
Sigma
