Suspicious BCDEdit Safe Mode Modification

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the use of BCDEdit to modify Windows boot configuration for Safe Mode with minimal services. In this configuration, Windows will only load the essential system services and drivers, and will not load any third-party software or drivers, including security programs like antivirus and EDRs. This technique is often used by attackers to disable or bypass security software, and is considered potentially malicious activity.

2025-04-24 00:00:00

None

9b232a44-5046-4691-a066-88ef3c084f1f

attack.defense-evasion attack.t1562.009

Nextron Sigma feed only (private)