Force Safe Mode Boot or Tamper SafeBoot Configuration (AN0323)
Detects command-line execution of bcdedit.exe used to force the system into Safe Mode boot, or reg.exe modifying SafeBoot configuration keys to inject persistent drivers/services.
Sigma
Detects command-line execution of bcdedit.exe used to force the system into Safe Mode boot, or reg.exe modifying SafeBoot configuration keys to inject persistent drivers/services.
Already have an account?