diff --git a/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml b/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml index 8e26465f..8aac89fd 100644 --- a/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml +++ b/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml @@ -6,6 +6,8 @@ rule: scope: function att&ck: - Impact::Inhibit System Recovery [T1490] + mbc: + - Impact::Disk Content Wipe::Delete Shadow Drive [F0014.001] examples: - B87E9DD18A5533A09D3E48A7A1EFBCF6:0x140006AF0 features: