Windows Registry Modification for Safe Mode Persistence

This analytic identifies modifications to the SafeBoot registry keys, specifically within the Minimal and Network paths. Adversaries can use these keys to persist drivers or services in Safe Mode, with Network allowing network connections. If confirmed malicious, this activity could enable attackers to maintain persistence even in Safe Mode, potentially bypassing certain security measures and facilitating further malicious actions.