Technique.View on attack.mitre.org
Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.
Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.
Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. Modify Registry). Malicious Component Object Model (COM) objects may also be registered and loaded in safe mode.
Rules on DetectionCode tagged with T1688.
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Windows EFI Volume Mount Attempt Via Mountvol | Anomaly | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
None recorded.
None recorded.
| Used by | Procedure example |
|---|---|
| MalwareAvosLocker | AvosLocker can restart a compromised machine in safe mode. |
| MalwareBlack Basta | Black Basta can reboot victim machines in safe mode with networking via `bcdedit /set safeboot network`. |
| MalwareEmbargo | Embargo has used a DLL variant of MDeployer to disable security solutions through Safe Mode. |
| MalwareLockBit 3.0 | LockBit 3.0 can reboot the infected host into Safe Mode. |
| MalwareQilin | Qilin can reboot targeted systems in safe mode to avoid detection. |
| MalwareRansomHub | RansomHub can reboot targeted systems into Safe Mode prior to encryption. |
| MalwareREvil | REvil can force a reboot in safe mode with networking. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
