Safe mode is a repair tool. MITRE ATT&CK T1688, Safe Mode Boot, covers adversaries who use it to switch off endpoint defenses. It belongs to the Defense Impairment tactic and applies to Windows.
How attackers use it
Safe mode starts Windows with a limited set of drivers and services, in two forms: Safe Mode and Safe Mode with Networking. Third-party security software such as EDR may not start in that state, while further services can still be started.
MITRE says a host can be forced into safe mode after its next reboot by changing Boot Configuration Data (BCD) stores. Adversaries may also add their own applications to the list of minimal services that start in safe mode by editing Registry values (see Modify Registry, T1112), and malicious COM objects may be registered and loaded there too.
Procedure examples on the page include several ransomware families that reboot machines into safe mode before encryption. One entry cites the command bcdedit /set safeboot network as the way a family reboots victims into safe mode with networking.
How to detect it
MITRE's detection strategy is to watch for abuse through BCD changes, boot configuration utilities (bcdedit.exe and bootcfg.exe) and registry persistence under the SafeBoot keys. Suspicious boot configuration changes combined with registry edits that enable persistence or disable defenses make the case.
In practice:
- Alert on process creation for bcdedit.exe with safeboot arguments, using process creation logs such as Sysmon event ID 1 or Windows event 4688 with command line logging.
- Alert on registry writes under the SafeBoot keys, for example with Sysmon event ID 13.
- Alert on unplanned reboots that are followed by a boot into safe mode on hosts that nobody was repairing.
How to reduce the risk
- Software configuration. Make sure endpoint defenses run in safe mode. Check with your EDR vendor how to enable this.
- Privileged account management. Limit administrator accounts to as few people as possible, following least privilege, since these accounts can be abused to remotely reboot a machine into safe mode.
Check your own environment
Read-only checks, run in an elevated prompt on Windows:
bcdedit /enum
reg query HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /s
The first shows the boot entry, where a safeboot value on a machine that is not under repair is a flag. The second lists the minimal and network service lists, so look for entries you do not recognize.
Also confirm in a test that your EDR sensor starts and reports from safe mode.
Quick check
Why does safe mode help an attacker who wants to disable defenses?
Safe mode loads only a limited set of drivers and services, so third-party security tools may not start. Anything the attacker added to the safe mode service list still runs.
