UEFI bootkit Secure Boot bypass prep: bcdedit, mountvol ESP, bootmgfw (Baton Dro
Detects potential system tampering via boot configuration modifications (bcdedit.exe with integrity/testsigning options), EFI System Partition (ESP) mounting (mountvol.exe /s), or unauthorized bootloader/bcdboot activity executed from non-standard parent processes.
Microsoft Sentinel (KQL)
