Windows Boot Configuration Tampering via bcdedit.exe
Flags bcdedit.exe commands that set boot status policy to ignore failures and disable recovery (recoveryenabled=no).
- Product
- windows
- Category
- process_creation
- Author
- E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-24
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies execution of bcdedit.exe commands that set boot status and recovery-related settings to values consistent with disabling protections or recovery behaviors. Attackers may use boot configuration tampering to hinder recovery and facilitate destructive follow-on activity. It relies on Windows process creation telemetry, matching the process identity (bcdedit.exe) and specific command-line arguments such as bootstatuspolicy, ignoreallfailures, recoveryenabled, and no.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md
- eqllib.readthedocs.iohttps://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Boot Configuration Tampering via bcdedit.exe
id: bccb1d41-984b-4555-8e5b-9c2f2fe55a9f
status: stable
description: This rule identifies execution of bcdedit.exe commands that set boot status and recovery-related settings to values consistent with disabling protections or recovery behaviors. Attackers may use boot configuration tampering to hinder recovery and facilitate destructive follow-on activity. It relies on Windows process creation telemetry, matching the process identity (bcdedit.exe) and specific command-line arguments such as bootstatuspolicy, ignoreallfailures, recoveryenabled, and no.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md
- https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2023-02-15
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \bcdedit.exe
- OriginalFileName: bcdedit.exe
selection_set:
CommandLine|contains: set
selection_cli:
- CommandLine|contains|all:
- bootstatuspolicy
- ignoreallfailures
- CommandLine|contains|all:
- recoveryenabled
- no
condition: all of selection_*
falsepositives:
- Unlikely
level: high
simulation:
- type: atomic-red-team
name: Windows - Disable Windows Recovery Console Repair
technique: T1490
atomic_guid: cf21060a-80b3-4238-a595-22525de4ab81
license: DRL-1.1
related:
- id: 1444443e-6757-43e4-9ea4-c8fc705f79a2
type: derived