Test Mode Enabled via Bcdedit

Daniel Koifman@Koifsec

•updated Feb 2, 2026•2•1•42

The rule detects the execution of bcdedit.exe with command-line arguments containing both "testsigning" and "on".