Safe Mode Boot `T1688`

Tactic: Defense Impairment

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.

Events covered

2 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Security-Auditing	Event ID 4688	A new process has been created.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	1	`in` 1	`* /s`, `-s*`
`OriginalFileName`	1	`eq` 1	`mountvol.exe`
`process_name`	1	`eq` 1	`mountvol.exe`

Top indicator values (4 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`CommandLine`	`in`	`* /s*` splunkWindows EFI Volume Mount Attempt Via Mountvol	1	2
`CommandLine`	`in`	`-s` splunkWindows EFI Volume Mount Attempt Via Mountvol	1	5
`OriginalFileName`	`eq`	`mountvol.exe` splunkWindows EFI Volume Mount Attempt Via Mountvol	1
`process_name`	`eq`	`mountvol.exe` splunkWindows EFI Volume Mount Attempt Via Mountvol	1	2

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Windows

Domain: Endpoint

Splunk 1 rule

Windows EFI Volume Mount Attempt Via Mountvol