Home/ATT&CK Technique/Safe Mode Boot
ATT&CK Technique

Safe Mode Boot

T1562.009 · stealth

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode.

There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot. Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot.

Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings. Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. Modify Registry).

Malicious Component Object Model (COM) objects may also be registered and loaded in safe mode.

Windows
◆

Actors Using This

14
russia_speaking_cybercrimeAkira
russia_speaking_cybercrimeALPHV / BlackCat
russia_speaking_cybercrimeBlack Basta
commercial_cybercrime_uefi_bootkitBlackLotus
unknown_likely_russia_aligned_alphv_lineageCicada3301
russia_speaking_organized_cybercrimeDarkSide / BlackMatter
unknown_likely_russia_alignedFog Ransomware
russia_speaking_cybercrimeLockBit Operators
russia_speaking_cybercrimeMedusa
russia_aligned_cybercrimePlay
russia_speaking_cybercrimeQilin
russia_speaking_cybercrimeRansomHub
russia_aligned_cybercrimeRhysida
russia_speaking_cybercrimeRoyal / BlackSuit
◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.
reconnaissance same
T1598 · Phishing for Information ×5.15T1598.003 · Spearphishing Link ×5.15
execution same
T1574.011 · Services Registry Permissions Weakness ×4.36
persistence same
T1078.001 · Default Accounts ×8.13T1078.004 · Cloud Accounts ×3.85
credential-access same
T1003.006 · DCSync ×7.48T1552.004 · Private Keys ×5.83T1212 · Exploitation for Credential Access ×3.50T1003.005 · Cached Domain Credentials ×3.28
collection same
T1530 · Data from Cloud Storage ×6.93
impact same
T1489 · Service Stop ×4.33T1491 · Defacement ×3.62
other same
T1562.002 · Disable Windows Event Logging ×5.67T1562.004 · Disable or Modify System Firewall ×4.07T1070.001 · Clear Windows Event Logs ×3.25
◈

Detection Coverage

0/6 layers
Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma) none
Analytics (MITRE CAR) none
Runtime / container (Falco) none
File / malware (YARA) none
Network (Suricata/Snort) none
Vuln scan (Nuclei) none
▣

Comply & Defend

NIST 800-53AC-02, AC-03, AC-05, AC-06, CM-05, CM-06, CM-07, CM-10, IA-02, IA-09, SC-08, SC-23, SI-07
D3FEND4 defensive techniques
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
MITRE ATT&CKAtomic Red Teamcar (MITRE)
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin