Alongside backup deletion, ransomware tooling modifies boot and recovery settings so that a failed or interrupted encryption does not drop the host into repair, and so that the payload can run in safe mode where many security products are not loaded. These changes use a small, recognisable command set, which makes them useful and low-noise early warnings.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| bcdedit recoveryenabled No | Sysmon 1, 4688 | T1490 |
| bcdedit bootstatuspolicy ignoreallfailures | Sysmon 1, 4688 | T1490 |
| bcdedit safeboot minimal or network, or bcdedit deletevalue safeboot | Sysmon 1, 4688 | T1562.009 |
| reagentc /disable | Sysmon 1, 4688 | T1490 |
| vssadmin resize shadowstorage to a tiny maximum | Sysmon 1, EDR | T1490 |
Boot Configuration Changes
The legitimate use of these bcdedit options is rare outside imaging and troubleshooting workflows. Alert on any use by a user session, a script host or a service account, and raise it to critical if safe-mode forcing is followed by a reboot command:
title: Boot Recovery Inhibition via bcdedit
logsource:
category: process_creation
product: windows
detection:
bcd:
Image|endswith: '\bcdedit.exe'
sel_recovery:
CommandLine|contains|all:
- 'recoveryenabled'
- 'no'
sel_statuspolicy:
CommandLine|contains|all:
- 'bootstatuspolicy'
- 'ignoreallfailures'
sel_safeboot:
CommandLine|contains: 'safeboot'
condition: bcd and 1 of sel_*
level: high
# tune/validate: allowlist your imaging and break-glass procedures by account and parent process
Recovery Environment and Shadow Storage
The same operators often disable the Windows Recovery Environment and shrink shadow storage so snapshots cannot be retained. Alert on the pair, and on any safe-mode boot setting followed by a restart:
// Defender / Sentinel (KQL) - recovery inhibition commands, grouped per device
DeviceProcessEvents
| where (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled", "bootstatuspolicy", "safeboot"))
or (FileName =~ "reagentc.exe" and ProcessCommandLine has "/disable")
or (FileName =~ "vssadmin.exe" and ProcessCommandLine has "resize shadowstorage")
| summarize cmds=make_set(ProcessCommandLine, 10), kinds=dcount(FileName), first=min(Timestamp)
by DeviceName, AccountName, bin(Timestamp, 1h)
| extend severity = iff(kinds >= 2, "critical", "high")
// tune/validate: exclude sanctioned imaging accounts and OS deployment servers
- Safe-mode forcing should page the team at once: the host will reboot into a state with reduced protection.
- If you catch it before the reboot, reverse the setting with bcdedit and isolate the host.
- Monitor for a scheduled task or run key that restarts the host shortly after the boot change.
- Record the full command lines. They help identify the tooling family and the other hosts to check.
SigmaHQ bcdedit, reagentc and shadow storage rules, Elastic impact-prevention detections, Splunk ESCU recovery-inhibition analytics and DFIR Report-style write-ups of safe-mode encryption. Check which of these commands your own deployment and imaging teams use before you alert.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts