Windows Boot Configuration Tampering via bcdedit.exe

Flags bcdedit.exe commands that set boot status policy to ignore failures and disable recovery (recoveryenabled=no).

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community (SigmaHQ), DRL 1.1
Published: 2019-10-24
Updated: 2026-07-31

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1490Inhibit System Recovery

What it detects

This rule identifies execution of bcdedit.exe commands that set boot status and recovery-related settings to values consistent with disabling protections or recovery behaviors. Attackers may use boot configuration tampering to hinder recovery and facilitate destructive follow-on activity. It relies on Windows process creation telemetry, matching the process identity (bcdedit.exe) and specific command-line arguments such as bootstatuspolicy, ignoreallfailures, recoveryenabled, and no.

Reporting behind it

Related detections9 linkedT1490 — drag to rearrange

Malicious Boot Configuration Set to Safe Mode with Networking via bcdedit

Shadow Copy Deletion via Vssadmin to Inhibit Recovery

Suspicious Symlink Evaluation Enabled via fsutil

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

Malicious Volume Shadow Copy Deletion via vssadmin

Suspicious Free Space Wipe via cipher.exe

Malicious Shadow Copy Deletion Via WMI

Windows Boot Configuration Tampering via bcdedit.exe

Pivot detection · T1490 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-boot-configuration-tampering-using-bcdedit-exe-set-1444443e

title: Windows Boot Configuration Tampering via bcdedit.exe
id: bccb1d41-984b-4555-8e5b-9c2f2fe55a9f
status: stable
description: This rule identifies execution of bcdedit.exe commands that set boot status and recovery-related settings to values consistent with disabling protections or recovery behaviors. Attackers may use boot configuration tampering to hinder recovery and facilitate destructive follow-on activity. It relies on Windows process creation telemetry, matching the process identity (bcdedit.exe) and specific command-line arguments such as bootstatuspolicy, ignoreallfailures, recoveryenabled, and no.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md
  - https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2023-02-15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \bcdedit.exe
    - OriginalFileName: bcdedit.exe
  selection_set:
    CommandLine|contains: set
  selection_cli:
    - CommandLine|contains|all:
        - bootstatuspolicy
        - ignoreallfailures
    - CommandLine|contains|all:
        - recoveryenabled
        - no
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
simulation:
  - type: atomic-red-team
    name: Windows - Disable Windows Recovery Console Repair
    technique: T1490
    atomic_guid: cf21060a-80b3-4238-a595-22525de4ab81
license: DRL-1.1
related:
  - id: 1444443e-6757-43e4-9ea4-c8fc705f79a2
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL