TrymeLocker Combined Recovery Destruction - bcdedit+VSS+SystemRestore (T1490)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects multiple concurrent attempts to inhibit Windows system recovery, a common behavior observed in the TrymeLocker ransomware family. The rule triggers when at least two distinct malicious activities occur on the same host within a 120-second window, including the disabling of the Windows Recovery Environment (WinRE) via bcdedit, deletion of shadow copies via vssadmin or wmic, disabling of the Windows backup service (wbengine) via sc, or disabling of System Restore via registry modification.