Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE

Title: Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE
Status: test
Description:Detects potential malicious and unauthorized usage of bcdedit.exe
References:
  -https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
  -https://twitter.com/malwrhunterteam/status/1372536434125512712/photo/2
Author: @neu5ron
Date: 2019-02-07
modified:2023-02-15
Tags:

• -'attack.stealth'
• -'attack.t1070'
• -'attack.persistence'
• -'attack.t1542.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\bcdedit.exe' OriginalFileName:'bcdedit.exe'   selection_cli:
    CommandLine|contains:
      -'delete'
      -'deletevalue'
      -'import'
      -'safeboot'
      -'network'

  condition:all of selection_*
Falsepositives:
Level: medium