Registry Persistence via Service in Safe Mode
Detects the modification of the Windows Registry to configure a driver or service to persist and load even when the system is booted into Safe Mode (Minimal or Network). This technique can be used by adversaries to maintain access and execute malicious code in a restricted environment, potentially bypassing security controls that are not active in Safe Mode.
Sigma
