Safe mode boot armed from a command line

Siemphony@siemphonymediumT1688unverified

AN0323 pairs boot-configuration changes with registry edits under the SafeBoot keys, and this rule matches the command-line form of both. The first arm is bcdedit.exe or bootcfg.exe with `safeboot` anywhere on the line, which covers `/set {default} safeboot minimal`, the `safeboot network` variant that keeps networking available for a remote operator, and `/deletevalue safeboot` — the removal is kept in deliberately, because an adversary reverting the change after the payload has run is as much of the behaviour as arming it, and excluding it would only hide the second half of the chain. The second arm keys on a command line naming `CurrentControlSet\Control\SafeBoot`, which is where a service or driver has to be registered for it to start in a limited boot; that string matches reg.exe and the PowerShell `HKLM:\SYSTEM\...` path form in one selection, since both spell the key the same way. MITRE's `SafeBootRegistryPaths` and `AllowedAdminTools` knobs are what the key string and the image list implement, populated here from the analytic's prose rather than taken from MITRE. Its `TimeWindow` knob — correlate the registry write with the boot-configuration command a few minutes either side — is a cross-event join with a timeframe, and lib/sigma models neither, so the two arms are ORed and either fires alone. The limit that matters most here is not a field problem. This rule sees the host being *armed* for safe mode; it cannot see the safe-mode session itself, because that boot is exactly when Sysmon, the EDR agent and the log shipper this telemetry depends on are the services that do not start. Whatever the adversary does after the reboot is likely to produce no events at all, so a single match here should be treated as the last thing you will see rather than as one signal among many. Vocabulary and prerequisites. AN0323 gives Security EventID 4688 for this leg and the brief maps it onto the Sigma `process_creation` category, which is Sysmon-EventID-1-shaped; this rule is written in that vocabulary (`Image`, `CommandLine`), so an estate feeding raw 4688 needs `NewProcessName` mapped onto `Image` first, and 4688 needs both *Audit Process Creation* and the separate *Include command line in process creation events* policy before `CommandLine` exists at all — neither is on in a default install or in the Microsoft and CIS baselines. The analytic's other three log sources (Sysmon EventID 12, 13 and 14 on `registry_add`, `registry_set` and `registry_rename`) are separate logsources and are not authored here; the consequence is that a SafeBoot value written through RegSetValueEx by an implant, imported with `regedit /s safeboot.reg` where the key sits inside the file, or set by msconfig — whose Safe boot checkbox edits the BCD store through the API and spawns no bcdedit — produces no match at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0116, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\bcdedit.exe" or FolderPath endswith "\\bootcfg.exe") and ProcessCommandLine contains "safeboot") or ProcessCommandLine contains "CurrentControlSet\\Control\\SafeBoot")

Splunk · SPL

Run this as a search.

index=* (((Image="*\\bcdedit.exe" OR Image="*\\bootcfg.exe") AND CommandLine="*safeboot*") OR CommandLine="*CurrentControlSet\\Control\\SafeBoot*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\bcdedit.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bootcfg.exe") AND TO_LOWER(process.command_line) LIKE "*safeboot*") OR TO_LOWER(process.command_line) LIKE "*currentcontrolset\\\\control\\\\safeboot*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\bcdedit\.exe$|\\bootcfg\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)safeboot</field>    <description>Safe mode boot armed from a command line (1/2)</description>    <mitre>      <id>T1688</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)CurrentControlSet\\Control\\SafeBoot</field>    <description>Safe mode boot armed from a command line (2/2)</description>    <mitre>      <id>T1688</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: defense_evasion_disable_tools
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8262cec8-a024-4048-9e3d-47e8d12fa29d

ATT&CKT1688

T1688Safe Mode Boot

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion disable tools

defense evasion disable toolsAI draft — unreviewed

01 · What this rule detects

The rule matches the moment a host is armed for safe mode, or a service is registered to survive that boot. It does not see the safe-mode session. That is the point worth internalising: safe mode is exactly when Sysmon, the EDR agent and the log shipper are the services that do not start. Whatever happens after the reboot is likely to produce nothing at all, so a single match here is better treated as the last thing you will see than as one signal among many.

02 · Telemetry you need

One source: Sigma process_creation / windows, taken from AN0323's Security 4688 entry. The category is Sysmon-EventID-1-shaped and the rule is written in that vocabulary — Image, CommandLine. An estate feeding raw 4688 must map NewProcessName onto Image first. 4688 itself needs two policies that are off in a default install and in the Microsoft and CIS baselines: Audit Process Creation, and the separate Include command line in process creation events. Without the second, CommandLine does not exist and the rule returns zero rows — which reads as quiet when it means blind. AN0323's other three sources (Sysmon 12, 13 and 14) are separate logsources and are not authored here.

03 · How the logic works

selection_boot_config_tool requires Image|endswith one of \bcdedit.exe or \bootcfg.exe together with CommandLine|contains: 'safeboot'. That one token carries three cases: /set {default} safeboot minimal, the safeboot network variant that keeps a remote operator connected, and /deletevalue safeboot. The removal is kept in deliberately — reverting after the payload has run is half the chain, and excluding it would hide the half that shows intent. selection_safeboot_key gates on one string, CurrentControlSet\Control\SafeBoot (written with doubled backslashes in the YAML, since \\ in Sigma is one literal backslash). That is the key a service must appear under to start in a limited boot, and reg.exe and the PowerShell HKLM:\SYSTEM\... path form spell it the same way, so a single term covers both. The condition is 1 of selection*. MITRE's TimeWindow knob asks you to correlate the registry write with the boot command a few minutes either side; that is a cross-event join with a timeframe and lib/sigma models neither, so the arms are simply ORed and either fires alone. MITRE's SafeBootRegistryPaths and AllowedAdminTools knobs are what the key string and the image list implement — the values in both are the pipeline's own, read out of the analytic's prose.

04 · Common false positives

Both arms are dual-use. Anti-malware removal utilities, rootkit cleaners and vendor uninstall tools shell out to bcdedit /set {default} safeboot minimal and then /deletevalue safeboot; that pair is the loudest benign source and is byte-for-byte the adversary's. Desktop support backing out a bad driver does the same by hand, and imaging and driver-qualification rigs script it in bursts. On the registry arm, the published remediation reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer /ve /t REG_SZ /d Service /f and its per-vendor equivalents match exactly. That arm also cannot separate a write from a read — reg query of the same key from a compliance scan is indistinguishable.

05 · Detection maturity

tier_1: Lowest tier. This rule was authored from MITRE prose and has never been run against a log line, so it has no measured hit rate and no evidence it fires on the technique. It moves up only once someone arms safe mode in a lab, confirms the events land with CommandLine populated, and measures production volume.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline the bcdedit callers first: a small set of remediation tools and support accounts usually produces nearly all of it, and excluding by ParentImage beats excluding by user. Do not tighten the registry arm with a /v or /d token — argument order and the PowerShell spelling defeat it, and you would trade real coverage for apparent precision. If the reads are unbearable, move that arm to the Sysmon registry_add/registry_set logsource the analytic also names, where a read generates no event. Know the blind spots before you trust a quiet console: RegSetValueEx, regedit /s, msconfig and the root\wmi BCD provider all produce no match, and a renamed copy of bcdedit.exe defeats the Image gate while the safeboot token stays true.

Declared by the author

Endpoint security and cleanup tooling that forces a limited boot on purpose. Anti-malware removal utilities, rootkit cleaners and vendor uninstall tools shell out to bcdedit /set {default} safeboot minimal to strip a stubborn infection and then bcdedit /deletevalue safeboot to put the host back, which is the same pair of commands this rule selects and is its loudest benign source.
Vendor support scripts making a service usable in safe mode by hand. The documented remediation for installing or repairing a product from a limited boot is reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer /ve /t REG_SZ /d Service /f, and backup, encryption and antivirus vendors publish the same reg add for their own service, so a technician following the KB or running the batch file it ships in produces a match.
Inventory, audit and support diagnostics reading the key rather than writing it. Compliance scripts and vendor support bundles run reg query HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot or the Get-ItemProperty equivalent to record which services are safe-mode capable, and the selection matches the key name wherever it appears on a command line, so a read is indistinguishable from a write.
Desktop support recovering a machine. Booting to safe mode to back out a bad driver or roll back an update is standard practice, and both halves of it — bcdedit /set {default} safeboot minimal and the bcdedit /deletevalue safeboot that follows the fix — match this rule identically to the adversary's use.
Build, imaging and driver-qualification automation. OS deployment task sequences, driver-signing and hardware-validation labs and automated test rigs script bcdedit safeboot changes as part of a reboot cycle, producing bursts of matches from a service account with nobody at the keyboard.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1688, evaluated against their process_creation events.

Share this rule

/u/siemphony/8262cec8-a024-4048-9e3d-47e8d12fa29d

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Safe mode boot armed from a command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it