Dolphin X bootkit persistence via boot configuration (BCD) modification
Detects suspicious modifications to Windows Boot Configuration Data (BCD) using bcdedit.exe by unsigned or non-standard processes outside defined maintenance windows. This behavior is associated with the Dolphin X malware's bootkit persistence module, designed to gain control before the operating system initializes.
Microsoft Sentinel (KQL)
