BCDEdit Safe Mode Command Execution

[rule]
description = """
Identifies when the command-line tool for managing Boot Configuration Data (BCDEdit.exe) is spawned from an untrusted
process, office application, or script interpreter and used to specify a reboot into Safe Mode.
"""
id = "6d660b32-23bf-434b-a588-1cdc91224664"
license = "Elastic License v2"
name = "BCDEdit Safe Mode Command Execution"
os_list = ["windows"]
reference = [
    "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/",
    "https://community.spiceworks.com/how_to/94471-how-to-reboot-into-safe-mode-at-a-command-prompt",
]
version = "1.0.32"

query = '''
process where event.action == "start" and
  (process.name : "bcdedit.exe" or process.pe.original_file_name : "bcdedit.exe") and
  process.args : ("minimal", "network", "safebootalternateshell") and
    descendant of
      [process where event.action == "start" and
        (process.code_signature.trusted != true or
         process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "MSPUB.EXE",
                         "OUTLOOK.EXE", "fltldr.exe", "cscript.exe", "powershell.exe", "pwsh.exe",
                         "wscript.exe", "cmd.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe",
                         "msbuild.exe"))
      ]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"

[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"

[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1490"
name = "Inhibit System Recovery"
reference = "https://attack.mitre.org/techniques/T1490/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"