Safe Mode Boot

let BcdEditSafeMode = dynamic([
  "safeboot", "safebootalternateshell",
  "{current}", "{default}"
]);
let SafeModeRegistryPaths = dynamic([
  "SafeBoot\\Minimal",
  "SafeBoot\\Network"
]);
union
(
  DeviceProcessEvents
  | where Timestamp > ago(24h)
  | where FileName =~ "bcdedit.exe"
  | where ProcessCommandLine has_any ("safeboot", "/set", "network", "minimal")
  | extend IsSafeBootSet = ProcessCommandLine has "safeboot"
  | extend IsNetworkMode = ProcessCommandLine has "network"
  | extend IsDeleteSafeBoot = ProcessCommandLine has "deletevalue" and ProcessCommandLine has "safeboot"
  | project Timestamp, DeviceName, AccountName, FileName,
           ProcessCommandLine, InitiatingProcessFileName,
           InitiatingProcessCommandLine,
           IsSafeBootSet, IsNetworkMode, IsDeleteSafeBoot
),
(
  DeviceRegistryEvents
  | where Timestamp > ago(24h)
  | where RegistryKey has_any (SafeModeRegistryPaths)
  | where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
  | project Timestamp, DeviceName, AccountName,
           RegistryKey, RegistryValueName, RegistryValueData,
           InitiatingProcessFileName, InitiatingProcessCommandLine,
           ActionType
),
(
  DeviceProcessEvents
  | where Timestamp > ago(24h)
  | where FileName =~ "bootcfg.exe"
  | where ProcessCommandLine has "/raw" and ProcessCommandLine has_any ("safeboot", "/SAFEBOOT")
  | project Timestamp, DeviceName, AccountName, FileName,
           ProcessCommandLine, InitiatingProcessFileName,
           InitiatingProcessCommandLine
)
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\bcdedit.exe" OR Image="*\\bootcfg.exe")
  (CommandLine="*safeboot*" OR CommandLine="*SAFEBOOT*" OR CommandLine="*/set*safeboot*")
| eval CommandLine=lower(CommandLine)
| eval IsSafeBootSet=if(match(CommandLine, "safeboot"), 1, 0)
| eval IsNetworkMode=if(match(CommandLine, "(safeboot\s+network|network)") AND match(CommandLine, "safeboot"), 1, 0)
| eval IsMinimalMode=if(match(CommandLine, "(safeboot\s+minimal|minimal)") AND match(CommandLine, "safeboot"), 1, 0)
| eval IsDeleteSafeBoot=if(match(CommandLine, "deletevalue.*safeboot"), 1, 0)
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, IsSafeBootSet, IsNetworkMode, IsMinimalMode, IsDeleteSafeBoot
| sort - _time
| append [
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
    TargetObject="*SafeBoot\\*"
  | table _time, host, User, Image, TargetObject, Details
  | sort - _time
]

sequence by host.name with maxspan=5m
[
  any where (
    (process.name : "bcdedit.exe" and
      process.args : ("safeboot", "/set", "network", "minimal", "{current}", "{default}")
    ) or
    (process.name : "bootcfg.exe" and
      process.args : ("/raw") and process.args : ("safeboot", "/SAFEBOOT")
    ) or
    (event.category : "registry" and event.type : ("creation", "change") and
      registry.path : ("*SafeBoot\\Minimal\\*", "*SafeBoot\\Network\\*")
    )
  )
]
| head 500

OR

sequence by host.name with maxspan=1m
[
  process where event.type == "start" and
    process.name : "bcdedit.exe" and
    process.args : "safeboot"
]
[
  process where event.type == "start" and
    process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  "Computer Name" AS host_name,
  "Process Name" AS process_name,
  "Command Line" AS command_line,
  "Parent Process Name" AS parent_process,
  CATEGORYNAME(category) AS event_category,
  QIDNAME(qid) AS event_name
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 352, 382)
  AND devicetime > (NOW() - 86400000)
  AND (
    (
      LOWER("Process Name") LIKE '%bcdedit.exe'
      AND (
        LOWER("Command Line") LIKE '%safeboot%'
        OR LOWER("Command Line") LIKE '%/set%'
      )
    )
    OR (
      LOWER("Process Name") LIKE '%bootcfg.exe'
      AND LOWER("Command Line") LIKE '%safeboot%'
    )
    OR (
      LOWER("Object Name") LIKE '%safeboot\\minimal%'
      OR LOWER("Object Name") LIKE '%safeboot\\network%'
    )
  )
ORDER BY devicetime DESC
LIMIT 500

_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*endpoint*
| where _raw matches /(?i)(bcdedit|bootcfg)/
| parse regex field=_raw "(?i)CommandLine[\s\S]*?(?P<command_line>[^\r\n]{0,500})" nodrop
| parse regex field=_raw "(?i)Image[\s\S]*?(?P<process_image>[^\r\n]{0,300})" nodrop
| parse regex field=_raw "(?i)TargetObject[\s\S]*?(?P<registry_key>[^\r\n]{0,500})" nodrop
| parse regex field=_raw "(?i)User[\s\S]*?(?P<user_name>[^\r\n]{0,100})" nodrop
| parse regex field=_raw "(?i)Computer[\s\S]*?(?P<computer_name>[^\r\n]{0,100})" nodrop
| where (
    (toLowerCase(process_image) matches "*bcdedit.exe*" AND (
      toLowerCase(command_line) matches "*safeboot*" OR
      toLowerCase(command_line) matches "*/set*"
    )) OR
    (toLowerCase(process_image) matches "*bootcfg.exe*" AND
      toLowerCase(command_line) matches "*safeboot*"
    ) OR
    (
      toLowerCase(registry_key) matches "*safeboot\\minimal*" OR
      toLowerCase(registry_key) matches "*safeboot\\network*"
    )
  )
| eval is_safeboot_set = if(toLowerCase(command_line) matches "*safeboot*", 1, 0)
| eval is_network_mode = if(toLowerCase(command_line) matches "*network*" AND toLowerCase(command_line) matches "*safeboot*", 1, 0)
| eval is_minimal_mode = if(toLowerCase(command_line) matches "*minimal*" AND toLowerCase(command_line) matches "*safeboot*", 1, 0)
| eval is_delete = if(toLowerCase(command_line) matches "*deletevalue*safeboot*", 1, 0)
| fields _messageTime, computer_name, user_name, process_image, command_line, registry_key, is_safeboot_set, is_network_mode, is_minimal_mode, is_delete
| sort by _messageTime desc

rule t1562_009_safe_mode_boot {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1562.009 - Safe Mode Boot abuse. Adversaries use bcdedit.exe or bootcfg.exe to configure Windows safe mode, disabling EDR tools before ransomware execution. Covers both process execution and SafeBoot registry key modifications."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1562.009"
    severity = "CRITICAL"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1688/"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e.principal.process.file.full_path, `(?i)bcdedit\.exe$`)
        or re.regex($e.principal.process.file.full_path, `(?i)bootcfg\.exe$`)
      )
      and re.regex($e.target.process.command_line, `(?i)safeboot`)
    )
    or (
      $e.metadata.event_type = "REGISTRY_MODIFICATION"
      and (
        re.regex($e.target.registry.registry_key, `(?i)SafeBoot\\(Minimal|Network)`)
      )
    )

  condition:
    $e
}

// T1562.009 - Safe Mode Boot: bcdedit/bootcfg safe mode configuration
#event_simpleName=ProcessRollup2
| FileName = /(?i)bcdedit\.exe|bootcfg\.exe/
| CommandLine = /(?i)safeboot/
| eval is_safeboot_set = if(CommandLine = /(?i)safeboot/, "true", "false")
| eval is_network_mode = if(CommandLine = /(?i)network/ AND CommandLine = /(?i)safeboot/, "true", "false")
| eval is_minimal_mode = if(CommandLine = /(?i)minimal/ AND CommandLine = /(?i)safeboot/, "true", "false")
| eval is_delete = if(CommandLine = /(?i)deletevalue.*safeboot/, "true", "false")
| table([_timeutc, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine, is_safeboot_set, is_network_mode, is_minimal_mode, is_delete])
| sort(field=_timeutc, order=desc)
| limit 500

// Secondary: Registry modifications to SafeBoot keys
// Run as separate search:
// #event_simpleName=RegGenericValueUpdate OR #event_simpleName=RegValueUpdate
// | RegObjectName = /(?i)SafeBoot\\(Minimal|Network)/
// | table([_timeutc, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, FileName, CommandLine])
// | sort(field=_timeutc, order=desc)