TOKYOCORE bcdedit disables recovery, safe boot, and integrity checks
Detects the use of bcdedit.exe to modify boot configuration data in a way that disables system recovery features, ignores boot failures, or bypasses integrity checks. This activity is often associated with ransomware or malicious persistence mechanisms aimed at preventing system recovery or loading unsigned drivers.
Sigma
