Impair Defenses: Safe Mode Boot

Created the Tuesday 07 February 2023. Updated 6 months, 3 weeks ago.

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.

Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.

Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. Modify Registry). Malicious Component Object Model (COM) objects may also be registered and loaded in safe mode.

Technique Identifier

T1562.009

Technique Tags

Defense Evasion disable endpoint defenses Windows safe mode Boot Configuration Data (BCD) registry modification malicious Component Object Model (COM) objects bypass EDR disable endpoint defences

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Impair Defenses: Safe Mode Boot, Sub-technique T1562.009 - Enterprise | MITRE ATT&CK®