BCDedit Boot Configuration Modification
Detects attempts to modify the Boot Configuration Data (BCD) using bcdedit.exe. This rule specifically looks for commands that delete boot entries or values, enable safe boot with networking, disable recovery, or ignore boot status policy failures. Such modifications can be used by adversaries to establish persistence, evade defenses, or disrupt system recovery.
Microsoft Sentinel (KQL)
