Windows bcdedit.exe Used to Delete Boot Configuration or Enable Special Boot Modes

title: Windows bcdedit.exe Used to Delete Boot Configuration or Enable Special Boot Modes
id: ae12b678-3df4-4d54-9105-aa6a26433fa0
status: test
description: This rule flags process executions of bcdedit.exe where the command line contains boot-configuration tampering actions such as delete, deletevalue, import, safeboot, or network. Attackers and unauthorized administrators can use these options to alter system boot settings for persistence, stealth, or recovery-evasion. The detection relies on Windows process creation telemetry and matching on the executable name (image/OriginalFileName) and specific command-line substrings.
references:
  - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
  - https://twitter.com/malwrhunterteam/status/1372536434125512712/photo/2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcdedit_susp_execution.yml
author: "@neu5ron, Huntrule Team"
date: 2019-02-07
modified: 2023-02-15
tags:
  - attack.stealth
  - attack.t1070
  - attack.persistence
  - attack.t1542.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \bcdedit.exe
    - OriginalFileName: bcdedit.exe
  selection_cli:
    CommandLine|contains:
      - delete
      - deletevalue
      - import
      - safeboot
      - network
  condition: all of selection_*
level: medium
license: DRL-1.1
related:
  - id: c9fbe8e9-119d-40a6-9b59-dd58a5d84429
    type: derived