Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Hive – Recovery Disable (bcdedit) Paired with Windows Event Log Clearing

Hive Shadow Copy Deletion Sentinel
MITRE ATT&CK
Inhibit System Recovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools/ttps dataset (hive); public Hive ransomware advisories
What This Detects
Hive is documented disabling Windows recovery via bcdedit (recoveryenabled no / bootstatuspolicy ignoreallfailures) and clearing event logs with wevtutil in the same operational window, ahead of encryption.
Query
let recoveryDisable = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no","bootstatuspolicy ignoreallfailures")
| project DeviceName, DisableTime = Timestamp;
let logClear = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "wevtutil.exe" and ProcessCommandLine has "cl "
| project DeviceName, ClearTime = Timestamp;
recoveryDisable
| join kind=inner logClear on DeviceName
| where ClearTime - DisableTime between (0min .. 1h)
| project DeviceName, DisableTime, ClearTime

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.