Akira: Safe Mode with Networking Reboot via bcdedit safeboot

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•3

Detects the use of bcdedit.exe to modify the boot configuration to enable Safe Mode with Networking. This is often used by adversaries to bypass security controls or to prepare a system for activities while in a state where many security products may not load or function.