{"id":"T1688","name":"Safe Mode Boot","url":"https://attack.mitre.org/techniques/T1688","tactics":["defense-impairment"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0116","stix_id":"x-mitre-detection-strategy--8c92a33f-ac2f-4ae9-9258-7a6a67922ad4","name":"Detection Strategy for Safe Mode Boot Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0116","analytics":[{"id":"AN0323","stix_id":"x-mitre-analytic--d7a82fc6-047b-47a8-8b3c-d6dcab00d56b","name":"Analytic 0323","description":"Abuse of safe mode via BCD modification, boot configuration utilities (bcdedit.exe, bootcfg.exe), and registry persistence under SafeBoot keys. Defender view: suspicious boot configuration changes correlated with registry edits that enable adversary persistence or disable defenses.","url":"https://attack.mitre.org/detectionstrategies/DET0116#AN0323","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=12","data_component":"DC0056","data_component_name":"Windows Registry Key Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"SafeBootRegistryPaths","description":"Customize monitored registry paths for safe mode service additions."},{"field":"AllowedAdminTools","description":"Whitelist legitimate administrative use of bcdedit/bootcfg for troubleshooting."},{"field":"TimeWindow","description":"Correlate registry modifications and boot configuration commands within a short timeframe."}],"live":true,"detection_strategies":["DET0116"],"techniques":["T1688"]}],"live":true,"version":"1.0","techniques":["T1688"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}