The Gentlemen RaaS: Multi-Command System Recovery Inhibition Pre-Ransomware (T1490)
This rule detects multiple distinct attempts to inhibit system recovery features on Windows systems. It monitors for the execution of native tools like vssadmin.exe, wmic.exe, bcdedit.exe, and wbadmin.exe, as well as PowerShell commands, to delete shadow copies, disable recovery features, or remove backup catalogs. By correlating these events over a 5-minute window, it identifies potentially malicious activity aimed at preventing system recovery, which is a common behavior in ransomware attacks.
Cortex XDR
