The Detection Gap: MITRE ATT&CK T1490
Symantec, Wednesday, October 14th, 2026
Symantec explains how to tell legitimate shadow copy deletion from ransomware's inhibit-system-recovery step (T1490).
In its Detection Gap series, Symantec examines MITRE ATT&CK technique T1490, Inhibit System Recovery, which often appears just before ransomware damage becomes irreversible and, Symantec argues, forces victims toward paying rather than restoring.
Deleting volume shadow copies removes one of the last recovery options, but backup admins also do it routinely, and the command looks identical either way.
The post explains how to distinguish legitimate activity from an attack by catching the surrounding pattern rather than the command alone.