Storm-1175 - Safe Mode Boot Modification (T1562.009)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Detects the use of bcdedit to configure the system to boot into Safe Mode with Networking, a technique often used by malware like Storm-1175 to bypass EDR during the encryption phase.