BCDedit Boot Configuration Modification
Detects modifications to the Boot Configuration Data (BCD) using bcdedit.exe that could indicate an attempt to disable recovery options, enable safe boot with networking, or ignore boot failures. This activity can be indicative of persistence mechanisms, bootkit installation, or attempts to hinder system recovery.
Microsoft Sentinel (KQL)
