Detecting Boot and Recovery Configuration Tampering

Many ransomware operations change the boot configuration so the victim cannot use automatic repair or recovery. The usual changes are short bcdedit commands that turn off recovery and ignore boot failures, or reagentc commands that disable the Windows Recovery Environment. Some operators also reboot into safe mode to avoid security tooling. These are administrator commands with few legitimate callers, so they make high-value detections.

Signals at a Glance

Command Coverage

These commands are short and consistent, so a command-line rule has good precision. The rule below combines recovery disable, boot status policy and safe-mode forcing. Legitimate technicians use bcdedit during imaging and troubleshooting, so scope it by parent and account:

title: Boot Configuration Or Recovery Environment Tampering
logsource:
  product: windows
  category: process_creation
detection:
  recovery_off:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains|all:
      - 'recoveryenabled'
      - 'no'
  boot_policy:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains|all:
      - 'bootstatuspolicy'
      - 'ignoreallfailures'
  safe_mode:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains|all:
      - 'safeboot'
      - '/set'
  winre_off:
    Image|endswith: '\reagentc.exe'
    CommandLine|contains: '/disable'
  condition: 1 of them
level: high
# tune/validate: allow your imaging servers and deployment accounts by name.

Sequence and Context

A single bcdedit call can be a technician. The same call within minutes of shadow copy deletion and service stops is a ransomware chain. Score the sequence on a single host:

• Alert on two or more of: shadow copy deletion, boot configuration change, backup catalog deletion and security-service stops on one host within 30 minutes.
• Check parent process and logon type. These commands launched by PsExec, a remote service or a script host under a domain admin are the strong cases.
• Safe-mode boot changes deserve their own alert, since they precede a reboot that the security stack may not survive. If you see one, check for a scheduled reboot before it happens.
• Inventory legitimate callers once (imaging, patching, VDI tooling), and allowlist by signed image and account rather than loosening the command match.