T1688 — Safe Mode Boot

Tactic: Defense Impairment · Platforms: Windows

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode.…

Sigma detection rules (1)

T1688 Safe Mode Boot

title: T1688 Safe Mode Boot
id: 8b7c24d0-f39e-498a-9cdc-71233292edd7
description: 'Detection strategy for Safe Mode Boot abuse via SafeBoot registry key modification or bcdedit safeboot configuration. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: SafeBootRegistryPaths, AllowedAdminTools, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1688
author: Shahrukh Khan
date: 2026-04-13
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1688

logsource:
  product: windows
  service: sysmon

detection:
  selection_saferegistry:
    EventID:
      - '13'
      - '14'
    TargetObject|contains:
      - '\CurrentControlSet\Control\SafeBoot\Minimal\'
      - '\CurrentControlSet\Control\SafeBoot\Network\'
  selection_bcdedit:
    EventID: '1'
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'safeboot minimal'
      - 'safeboot network'
      - '/safeboot'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_saferegistry or selection_bcdedit) and not filter_system_account

falsepositives:
  - Legitimate troubleshooting reboots into Safe Mode.

level: medium

Explore