Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE
This rule detects potential malicious and unauthorized usage of 'bcdedit.exe' by monitoring process creation events. Specifically, it looks for 'bcdedit.exe' being executed with command-line arguments related to deleting boot entries or values, importing boot data, or enabling safe boot with network capabilities. Such commands can be indicative of ransomware attempting to tamper with the Master Boot Record (MBR) or other boot configurations to prevent system startup or establish persistence, or other forms of bootkit activity.
Sigma
