T1562.009 Safe Mode Boot Mappings

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Safe Mode)(Citation: Sophos Snatch Ransomware 2019)

Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit 2021)

Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. Modify Registry). Malicious Component Object Model (COM) objects may also be registered and loaded in safe mode.(Citation: Sophos Snatch Ransomware 2019)(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason Nocturnus MedusaLocker 2020)(Citation: BleepingComputer REvil 2021)

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-02 Account Management Protects T1562.009 Safe Mode Boot
AC-03 Access Enforcement Protects T1562.009 Safe Mode Boot
AC-05 Separation of Duties Protects T1562.009 Safe Mode Boot
AC-06 Least Privilege Protects T1562.009 Safe Mode Boot
CM-10 Software Usage Restrictions Protects T1562.009 Safe Mode Boot
CM-05 Access Restrictions for Change Protects T1562.009 Safe Mode Boot
CM-06 Configuration Settings Protects T1562.009 Safe Mode Boot
CM-07 Least Functionality Protects T1562.009 Safe Mode Boot
IA-02 Identification and Authentication (organizational Users) Protects T1562.009 Safe Mode Boot
IA-09 Service Identification and Authentication Protects T1562.009 Safe Mode Boot
SC-23 Session Authenticity Protects T1562.009 Safe Mode Boot
SC-08 Transmission Confidentiality and Integrity Protects T1562.009 Safe Mode Boot
SI-07 Software, Firmware, and Information Integrity Protects T1562.009 Safe Mode Boot