Windows Boot Configuration Tampering Using bcdedit.exe set

title: Windows Boot Configuration Tampering Using bcdedit.exe set
id: bccb1d41-984b-4555-8e5b-9c2f2fe55a9f
status: stable
description: This rule identifies process executions of bcdedit.exe where the command line includes 'set' and targets boot configuration policy changes. It focuses on attempts to disable recovery behavior by setting bootstatuspolicy to ignoreallfailures and recoveryenabled to no. Such tampering can hinder system recovery after compromise and may increase the impact of destructive activity. Telemetry relies on Windows process creation fields including Image/OriginalFileName and CommandLine contents.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md
  - https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2023-02-15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \bcdedit.exe
    - OriginalFileName: bcdedit.exe
  selection_set:
    CommandLine|contains: set
  selection_cli:
    - CommandLine|contains|all:
        - bootstatuspolicy
        - ignoreallfailures
    - CommandLine|contains|all:
        - recoveryenabled
        - no
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
simulation:
  - type: atomic-red-team
    name: Windows - Disable Windows Recovery Console Repair
    technique: T1490
    atomic_guid: cf21060a-80b3-4238-a595-22525de4ab81
license: DRL-1.1
related:
  - id: 1444443e-6757-43e4-9ea4-c8fc705f79a2
    type: derived