• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    BCDedit Boot into Minimal Safe Mode

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    nomit vyas@xoxo
    •updated Apr 30, 2026•2•0•188

    Detects the execution of bcdedit to configure the system boot into minimal safe mode. VECT ransomware uses this technique to evade security products on the next reboot.

    CQL

    Tags

    TA0005 - Defense EvasionT1562.009 - Safe Mode BootProcess CreationCommand ExecutionWindows

    Found in

    • VECT 2.0 Ransomware Encryption Flaw Causes Data DestructionLast updated Apr 30, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?