Windows SafeBoot Configuration Modified via WMI

Mohamed Mostafa@0xHimmler

•updated Apr 29, 2026•12•1•135

Detects modification of Windows Boot Configuration Data (BCD) to enable SafeBoot (Minimal or Network) via WMI methods. This technique is commonly used by attackers to reboot the system into Safe Mode where EDR and AV kernel drivers are not loaded.