Impair Defenses: Safe Mode Boot

[williballenthin]

Impair Defenses: Safe Mode Boot
https://attack.mitre.org/techniques/T1562/009/

[williballenthin]

via modifications to Boot Configuration Data (BCD) stores

[williballenthin]

https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/

[williballenthin]

existing rule to manipulate boot configuration: https://github.com/mandiant/capa-rules/blob/master/host-interaction/bootloader/manipulate-boot-configuration.yml

[williballenthin]

to run in safe mode: adding a key to HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

[williballenthin]

a program can be forced to start on safe mode boot by adding a * in front of the "Startup" value name: HKLM\Software\Microsoft\Windows\CurrentVersion\Run["*Startup"="{{Path}}"]

[williballenthin]

https://www.tenforums.com/tutorials/2304-boot-into-safe-mode-windows-10-a.html

[williballenthin]

bootcfg is XP-specific.
bcdedit is vista+.
https://stackoverflow.com/questions/13975779/how-do-i-restart-a-computer-in-safe-mode-with-a-windows-script

[williballenthin]

bootcfg /raw /a /safeboot:network /id 1
bcdedit /set {current} safeboot network
bcdedit /set {current} safeboot minimal