Backup Files Deleted (06125661-3814-4e03-bfa2-1e4411c60ac3)
Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a) | Attack Pattern | Backup Files Deleted (06125661-3814-4e03-bfa2-1e4411c60ac3) | Sigma-Rules | 1 |