Akira: bcdedit Safe Mode with Networking configuration before EDR disruption
Detects the use of bcdedit.exe to configure the boot environment to start Windows in 'Safe Mode with Networking'. This behavior is commonly observed as an evasion technique used by threat actors, including Akira ransomware affiliates, to bypass EDR protections during pre-ransomware staging activities.
Microsoft Sentinel (KQL)
