TOKYOCORE Boot Sabotage via bcdedit (Disable Recovery/Safe Mode/Integrity Checks)
Detects malicious usage of bcdedit.exe to weaken system boot security. The rule flags commands that disable Windows Recovery (WinRE), boot integrity checks, driver signature enforcement, or force legacy boot policies, which are often used by ransomware like TOKYOCORE to prevent system recovery and hinder defensive remediation.
Cortex XDR
