Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
14
3
1
1
Contributors
5
3
2
2
2
Categories
13
6
2
2
1
Platforms
19
1
1
Products / Services
8
7
2
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects the execution of bcdedit to configure the system boot into minimal safe mode. VECT ransomware uses this technique to evade security products on the next reboot.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions — the value
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects Nightspire ransomware configuring the machine to boot into Safe Mode with Networking to bypass third-party EDR/AV solutions before initiating the encryption routine. This is achieved by executing 'bcdedit.exe' with parameters to set 'safeboot network'.
Detects the use of bcdedit to configure the system to boot into Safe Mode with Networking, a technique often used by malware like Storm-1175 to bypass EDR during the encryption phase.
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
Detects bcdedit modification to boot in safe mode to bypass security tools
This rule detects network traffic containing the strings "bcdedit" and "safeboot" over TCP port 445 (SMB). This combination suggests an attempt to remotely configure a system to boot into safe mode, which could be used by an attacker for defense evasion or to facilitate further malicious activities.
Detects creation or modification of the SafeBoot\Network\Remote Access Service registry key, a persistence mechanism used by the STAC6405 (VENOMOUS#HELPER) campaign. This ensures the SimpleHelp-based RAT survives Safe Mode with Networking reboots, which is a common remediation step for defenders. The specific 'Remote Access Service' subkey under SafeBoot\Network is a static Indicator of Compromise (IOC) for this campaign, as modifications to SafeBoot\Network are generally rare in benign Windows operations.
Detects the execution of bcdedit to configure the system boot into minimal safe mode. VECT ransomware uses this technique to evade security products on the next reboot.
Detects modification of Windows Boot Configuration Data (BCD) to enable SafeBoot (Minimal or Network) via WMI methods. This technique is commonly used by attackers to reboot the system into Safe Mode where EDR and AV kernel drivers are not loaded.
KQL Query from file: defendnot detection
'Provides the Anti virus mode and device count falling under that AV mode.'
Establishes a baseline SystemGuardSecurityLevel and show the devices that are below that baseline.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.