Safe Mode Boot

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Safe Mode)(Citation: Sophos Snatch Ransomware 2019)

Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit 2021)

Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: Sophos Snatch Ransomware 2019)(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason Nocturnus MedusaLocker 2020)(Citation: BleepingComputer REvil 2021)

Platforms: Windows
Tactics:
phase_name: defense-evasion

Detection:
Monitor Registry modification and additions for services that may start on safe mode. For example, a program can be forced to start on safe mode boot by adding a <code>\*</code> in front of the "Startup" value name: <code>HKLM\Software\Microsoft\Windows\CurrentVersion\Run\["\*Startup"="{Path}"]</code> or by adding a key to <code>HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal</code>.(Citation: BleepingComputer REvil 2021)(Citation: Sophos Snatch Ransomware 2019)

Monitor execution of processes and commands associated with making configuration changes to boot settings, such as <code>bcdedit.exe</code> and <code>bootcfg.exe</code>.(Citation: Microsoft bcdedit 2021)(Citation: Microsoft Bootcfg)(Citation: Sophos Snatch Ransomware 2019)

References:
source_name: mitre-attack
description: Microsoft. (n.d.). Start your PC in safe mode in Windows 10. Retrieved June 23, 2021.
source_name: Microsoft Safe Mode
description: Sophos. (2019, December 9). Snatch ransomware reboots PCs into Safe Mode to bypass protection. Retrieved June 23, 2021.
source_name: Sophos Snatch Ransomware 2019
description: Microsoft. (2021, May 27). bcdedit. Retrieved June 23, 2021.
source_name: Microsoft bcdedit 2021
description: Naim, D.. (2016, September 15). CyberArk Labs: From Safe Mode to Domain Compromise. Retrieved June 23, 2021.
source_name: CyberArk Labs Safe Mode 2016
description: Cybereason Nocturnus. (2020, November 19). Cybereason vs. MedusaLocker Ransomware. Retrieved June 23, 2021.
source_name: Cybereason Nocturnus MedusaLocker 2020
description: Abrams, L. (2021, March 19). REvil ransomware has a new ‘Windows Safe Mode’ encryption mode. Retrieved June 23, 2021.
source_name: BleepingComputer REvil 2021
description: Gerend, J. et al. (2017, October 16). bootcfg. Retrieved August 30, 2021.
source_name: Microsoft Bootcfg