Applied Cybernetics Group
T1688 Safe Mode Boot
- Technique
T1688- Tactics
- Defense Evasion
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 0
- Elastic, Splunk
- 1
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1688
MITRE description
Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Windows Startup Settings)(Citation: Sophos Safe Mode Boot) Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit) Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason safe mode boot)(Citation: BleepingComputer REvil 2021)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-08-12Huntress: Akira Hits Safe Mode: Ransomware Rebooting Around EDR