Detect Safe Mode Boot in IBM QRadar
Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores using bcdedit. Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values. This technique has been used by multiple ransomware families including REvil, Black Basta, LockBit 3.0, AvosLocker, Qilin, and RansomHub to encrypt files while EDR tools are inactive.
MITRE ATT&CK
- Tactic
- Defense Impairment
- Technique
- T1688 Safe Mode Boot
- Canonical reference
- https://attack.mitre.org/techniques/T1688/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
username,
"Computer Name" AS host_name,
"Process Name" AS process_name,
"Command Line" AS command_line,
"Parent Process Name" AS parent_process,
CATEGORYNAME(category) AS event_category,
QIDNAME(qid) AS event_name
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) IN (12, 352, 382)
AND devicetime > (NOW() - 86400000)
AND (
(
LOWER("Process Name") LIKE '%bcdedit.exe'
AND (
LOWER("Command Line") LIKE '%safeboot%'
OR LOWER("Command Line") LIKE '%/set%'
)
)
OR (
LOWER("Process Name") LIKE '%bootcfg.exe'
AND LOWER("Command Line") LIKE '%safeboot%'
)
OR (
LOWER("Object Name") LIKE '%safeboot\\minimal%'
OR LOWER("Object Name") LIKE '%safeboot\\network%'
)
)
ORDER BY devicetime DESC
LIMIT 500Detects T1562.009 Safe Mode Boot abuse in IBM QRadar by identifying bcdedit.exe or bootcfg.exe processes with safeboot-related command-line arguments, and registry events targeting SafeBoot\Minimal or SafeBoot\Network keys. Ransomware operators use this to evade EDR tools that do not load during safe mode.
Data Sources
Required Tables
False Positives & Tuning
- Administrators using bcdedit.exe to configure network boot or PXE settings in enterprise environments with legitimate diagnostic workflows
- Automated backup or disaster recovery tools that configure boot settings to ensure recovery modes are accessible
- Windows Subsystem for Linux (WSL) or Hyper-V configuration scripts that modify BCD settings as part of virtualization setup
Other platforms for T1688
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Enable Safe Mode with Networking via bcdedit
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine containing '/set {current} safeboot network'. Security Event ID 4688 (if command line auditing enabled). DeviceProcessEvents in MDE.
- Test 2 Register Service in Safe Mode via Registry
Expected signal: Sysmon Event ID 12: Registry Key Created for HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\df00tech-test-svc. Sysmon Event ID 13: Registry Value Set with TargetObject showing the key and Details='Service'. DeviceRegistryEvents in MDE.
- Test 3 Enable Minimal Safe Mode via bcdedit
Expected signal: Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine containing '/set {current} safeboot minimal'. DeviceProcessEvents in MDE with FileName=bcdedit.exe.
- Test 4 Force Reboot After Safe Mode Configuration
Expected signal: Sysmon Event ID 1: Two process creation events — bcdedit.exe and shutdown.exe. System Event ID 1074: Shutdown initiated with reason 'df00tech safe mode test'. After reboot, System Event ID 6005/6006 showing safe mode startup.
References (6)
- https://attack.mitre.org/techniques/T1688/
- https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/
- https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
- https://www.cyberark.com/resources/blog/cyberark-labs-from-safe-mode-to-domain-compromise
- https://www.cybereason.com/blog/medusalocker-ransomware
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bcdedit
Response Playbook
Triage
- Examine the full bcdedit command line — is it setting safeboot to 'network' or 'minimal'? Network mode is specifically favored by ransomware (REvil, Black Basta) because it allows network-based encryption.
- Identify the parent process — was bcdedit spawned by an expected administrative tool (cmd.exe from RMM, PowerShell from SCCM) or an unexpected binary (unknown .exe, script host, or a recently dropped executable)?
- Check for registry modifications to HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ or \Minimal\ — were any new service entries added that would allow a non-standard process to run in safe mode?
- Look for a pending reboot — check if shutdown.exe /r or restart-computer was executed shortly after the bcdedit command. Ransomware typically forces an immediate reboot.
- Check the user context — is this SYSTEM, a local admin, or a domain account? Ransomware often runs as SYSTEM after privilege escalation.
- Review recent file activity — look for mass file rename events (.encrypted, .locked, .basta extensions) or ransomware note creation (readme.txt, RECOVER-FILES.txt) on the same endpoint.
Containment
- IMMEDIATELY revert the BCD change before the system reboots: run 'bcdedit /deletevalue {current} safeboot' on the affected endpoint to prevent safe mode boot.
- If a reboot is imminent or has already occurred: isolate the endpoint from the network via EDR isolation or switch port shutdown to prevent lateral spread.
- If ransomware indicators are confirmed: trigger your ransomware response plan — isolate all endpoints in the same network segment and disable shared drive access.
- Block the initiating process hash across all endpoints via EDR global block rule.
- If the safe mode service registry key was modified: remove the malicious service entry from SafeBoot\Network and SafeBoot\Minimal before any reboot occurs.
Evidence Collection
- BCD store export: run 'bcdedit /enum all > bcd_export.txt' to capture the current boot configuration including any safeboot settings.
- Registry export: export HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal and SafeBoot\Network to identify any services added by the adversary.
- Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 for bcdedit.exe and any parent/child process chain.
- Sysmon Event ID 13 (Registry Value Set) — captures the exact registry modifications to SafeBoot keys with before/after values.
- File System Events — Sysmon Event ID 11 for any files dropped by the parent process of bcdedit (likely the ransomware payload).
- Scheduled Tasks — check for scheduled tasks created to run after reboot in safe mode (schtasks, at.exe, or WMI event subscriptions).
- Windows Event Log — System log Event ID 1074 (system shutdown/restart initiated) to confirm reboot timing.
Escalation Criteria
- !bcdedit /set safeboot network followed by shutdown /r within minutes — this is the canonical ransomware safe mode encryption pattern.
- !New service registered under SafeBoot\Network or SafeBoot\Minimal registry keys by a non-Windows binary — indicates malware persisting into safe mode.
- !Multiple endpoints showing bcdedit safeboot commands within a short time window — indicates automated ransomware propagation across the network.
- !Parent process of bcdedit is an unknown or recently created executable, especially one dropped in TEMP, AppData, or ProgramData directories.
- !The endpoint has concurrent indicators: shadow copy deletion (vssadmin delete shadows), security tool termination, and safeboot configuration.
Investigation Guide
Forensic Artifacts
- >
BCD Store: C:\Boot\BCD — binary file, can be parsed with bcdedit /enum or third-party tools to check safeboot configuration. - >
Registry: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ — lists services that start in minimal safe mode. - >
Registry: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ — lists services that start in safe mode with networking. - >
Event Log: System Event ID 1074 — records shutdown/restart requests with the initiating process and reason code. - >
Event Log: System Event ID 6006/6005 — records clean/dirty shutdown and startup, useful for confirming the reboot occurred. - >
Prefetch: C:\Windows\Prefetch\BCDEDIT.EXE-*.pf — execution timestamps for bcdedit. - >
Shimcache/Amcache: Evidence of bcdedit.exe execution even if prefetch is unavailable.
Tuning Guidance
Safe mode bcdedit modifications are rare in normal enterprise operations, making this a low-noise detection. The primary tuning need is excluding legitimate IT operations: (1) Allowlist specific RMM tools (ConnectWise, Datto, etc.) that may use bcdedit during remote troubleshooting — match on parent process path, not just name. (2) Correlate with your ITSM/ticketing system to auto-close alerts that correspond to an open maintenance ticket. (3) For the registry-based detection, exclude Windows servicing processes (services.exe, TiWorker.exe, TrustedInstaller.exe) which legitimately write to SafeBoot keys during updates. (4) Consider raising severity to CRITICAL if the bcdedit safeboot command is followed by shadow copy deletion (vssadmin delete shadows) or security service termination within the same process tree.
Hunting Queries
Hunt for the ransomware kill chain pattern: bcdedit safeboot configuration followed by a forced reboot within 30 minutes on the same device. This specific sequence is the hallmark of safe mode ransomware (REvil, Black Basta, LockBit 3.0, AvosLocker) and should be treated as critical if no maintenance ticket exists.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "bcdedit.exe"
| where ProcessCommandLine has "safeboot"
| join kind=inner (
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "shutdown.exe" or ProcessCommandLine has "Restart-Computer"
) on DeviceName
| where Timestamp1 > Timestamp and datetime_diff('minute', Timestamp1, Timestamp) < 30
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RebootCmd=ProcessCommandLine1, MinutesBetween=datetime_diff('minute', Timestamp1, Timestamp)index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\bcdedit.exe" CommandLine="*safeboot*"
| rename host as src_host, _time as bcdedit_time
| join src_host [
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\shutdown.exe" OR CommandLine="*Restart-Computer*")
| rename host as src_host, _time as reboot_time
]
| where reboot_time > bcdedit_time
| eval MinutesBetween=round((reboot_time - bcdedit_time) / 60, 1)
| where MinutesBetween < 30
| table bcdedit_time, src_host, User, CommandLine, MinutesBetweenHunt for non-system processes creating or modifying SafeBoot registry keys. Legitimate modifications to SafeBoot keys are rare and typically performed only by Windows servicing components. Any user-mode process writing to these keys is highly suspicious and may indicate ransomware registering itself as a safe mode service.
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has "SafeBoot"
| where ActionType == "RegistryKeyCreated" or ActionType == "RegistryValueSet"
| where InitiatingProcessFileName !in~ ("services.exe", "svchost.exe", "TiWorker.exe", "TrustedInstaller.exe")
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=12 OR EventCode=13
TargetObject="*SafeBoot*"
NOT (Image="*\\services.exe" OR Image="*\\svchost.exe" OR Image="*\\TiWorker.exe" OR Image="*\\TrustedInstaller.exe")
| table _time, host, User, Image, TargetObject, Details, EventCode
| sort - _timeHunt for unusual bcdedit usage patterns — repeated executions or execution across multiple devices from the same parent process or account. Ransomware that spreads laterally will show bcdedit being run by the same tool across many endpoints in a short time period.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "bcdedit.exe"
| summarize Count=count(), Commands=make_set(ProcessCommandLine), Devices=dcount(DeviceName) by InitiatingProcessFileName, AccountName
| where Count > 2 or Devices > 1
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\bcdedit.exe"
| stats count as Count, values(CommandLine) as Commands, dc(host) as Devices by ParentImage, User
| where Count > 2 OR Devices > 1
| sort - CountAtomic Red Team Tests
Uses bcdedit to configure the next boot into safe mode with networking — the exact command used by REvil, Black Basta, and LockBit 3.0 ransomware. This modifies the BCD store but does NOT force a reboot, making it safe for testing. The cleanup command reverts the setting.
Command
bcdedit /set {current} safeboot networkCleanup
bcdedit /deletevalue {current} safebootExpected Telemetry
Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine containing '/set {current} safeboot network'. Security Event ID 4688 (if command line auditing enabled). DeviceProcessEvents in MDE.
Expected Detection
KQL: DeviceProcessEvents query matches on FileName=bcdedit.exe with ProcessCommandLine containing 'safeboot' and 'network'. IsSafeBootSet=true, IsNetworkMode=true. SPL: IsSafeBootSet=1, IsNetworkMode=1.
Creates a new registry key under SafeBoot\Network to register a test service that would start in safe mode with networking. This is the technique used by ransomware to ensure their encryption binary runs even in safe mode. The cleanup removes the key.
Command
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\df00tech-test-svc" /ve /t REG_SZ /d "Service" /fCleanup
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\df00tech-test-svc" /fExpected Telemetry
Sysmon Event ID 12: Registry Key Created for HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\df00tech-test-svc. Sysmon Event ID 13: Registry Value Set with TargetObject showing the key and Details='Service'. DeviceRegistryEvents in MDE.
Expected Detection
KQL: DeviceRegistryEvents query matches on RegistryKey containing 'SafeBoot\Network'. SPL: Sysmon EventCode 12/13 with TargetObject containing 'SafeBoot'.
Uses bcdedit to configure the next boot into minimal safe mode (no networking). Some ransomware variants use minimal mode when they have already staged the payload locally and do not need network access for encryption.
Command
bcdedit /set {current} safeboot minimalCleanup
bcdedit /deletevalue {current} safebootExpected Telemetry
Sysmon Event ID 1: Process Create with Image=bcdedit.exe, CommandLine containing '/set {current} safeboot minimal'. DeviceProcessEvents in MDE with FileName=bcdedit.exe.
Expected Detection
KQL: DeviceProcessEvents query matches on FileName=bcdedit.exe with 'safeboot' and 'minimal'. IsSafeBootSet=true. SPL: IsSafeBootSet=1, IsMinimalMode=1.
Combines the full ransomware kill chain: set safe mode with networking, then schedule an immediate forced reboot. WARNING: This WILL reboot the test system. Only run on isolated test machines. The cleanup reverts the BCD setting but must be run before or after reboot.
Command
bcdedit /set {current} safeboot network && shutdown /r /f /t 5 /c "df00tech safe mode test"Cleanup
bcdedit /deletevalue {current} safebootExpected Telemetry
Sysmon Event ID 1: Two process creation events — bcdedit.exe and shutdown.exe. System Event ID 1074: Shutdown initiated with reason 'df00tech safe mode test'. After reboot, System Event ID 6005/6006 showing safe mode startup.
Expected Detection
KQL: Both DeviceProcessEvents queries fire — bcdedit safeboot and shutdown. Hunting query detects the bcdedit-then-reboot pattern within 30 minutes. SPL: Both process events detected.