Windows Recovery Disabled via bcdedit Modification
Detects the use of bcdedit.exe to disable automatic Windows recovery or suppress boot failure notifications. Adversaries often perform this action during the impact phase of an attack to prevent system restoration after data destruction or ransomware encryption.
Sigma
