Nightspire - BCDedit Recovery Disablement (T1490)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•4

Identifies Nightspire utilizing bcdedit.exe to modify boot configuration data, explicitly ignoring all boot failures and disabling the Windows recovery environment.