Destroying recovery points

ransomware_shadow_copy_delete

Deletes the machine's volume shadow copies with vssadmin and disables the boot recovery environment, the steps ransomware takes so a restore is impossible. This CANNOT be undone: the shadow copies are gone. It needs --allow-irreversible as well as consent.

Severity critical how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 1 Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

--i-understand
Needs explicit consent: this test changes machine state or fetches real offensive tooling.
--allow-irreversible
Cannot be undone. Consent alone is not enough, because "this machine is disposable" and "destroy the evidence of this run" are different decisions.
wants admin
Only fully works with administrative rights. It still runs without them — the refusal is itself informative — and the report says which it was.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1490	Inhibit System Recovery	Impact	coverage statistics
T1562.001	Disable or Modify Tools	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other ransomware behaviour tests

Other tests in the Ransomware behaviour category.
Test	What it does	Severity
In-place AES encryption of sandbox files ransomware_entropy_encrypt	Creates 120 low-entropy documents in the sandbox and encrypts every one of them in place with AES-256, so the on-disk entropy of each file jumps from …	high
Ransomware-style mass rename and rewrite ransomware_mass_rename	Creates 240 documents in a sandbox directory, then renames them all to a .locked extension, overwrites a subset with high-entropy data and drops a ran…	high
Real ransomware extensions and ransom notes ransomware_note_and_extensions	Renames sandbox documents to the extensions real families use (.locky, .wcry, .ryuk and others) and drops a ransom note in every subdirectory, which i…	high
Rate-controlled rename storm ransomware_rename_storm	Renames 600 sandbox files in paced batches of 50, recording how many had been renamed when something first intervened. That number is the detection th…	high
EDR canary/decoy directory probe ransomware_canary_probe	Read-only search for the canary and decoy files anti-ransomware products place on disk to detect mass file modification. Finding them shows behavioura…	low

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.