Boot Configuration Tampering Via Bcdedit.EXE
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware. Specifically, it looks for commands that disable boot status policy to ignore all failures and disable recovery enabled.
Sigma
