Elastic Defend high stable eql

BCDEdit Safe Mode Command Execution

Identifies when the command-line tool for managing Boot Configuration Data (BCDEdit.exe) is spawned from an untrusted process, office application, or script interpreter and used to specify a reboot into Safe Mode.

View Source

Detection Logic

process where event.action == "start" and
  (process.name : "bcdedit.exe" or process.pe.original_file_name : "bcdedit.exe") and
  process.args : ("minimal", "network", "safebootalternateshell") and
    descendant of
      [process where event.action == "start" and
        (process.code_signature.trusted != true or
         process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "MSPUB.EXE",
                         "OUTLOOK.EXE", "fltldr.exe", "cscript.exe", "powershell.exe", "pwsh.exe",
                         "wscript.exe", "cmd.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe",
                         "msbuild.exe"))
      ]

Field Validations

Loading…

Comments (0)

Loading comments...