Detectionhighstable

Boot Configuration Tampering Via Bcdedit.EXE

Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.communityCreated Thu Oct 24Updated Wed Feb 151444443e-6757-43e4-9ea4-c8fc705f79a2windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\bcdedit.exe'
        - OriginalFileName: 'bcdedit.exe'
    selection_set:
        CommandLine|contains: 'set'
    selection_cli:
        - CommandLine|contains|all:
              - 'bootstatuspolicy'
              - 'ignoreallfailures'
        - CommandLine|contains|all:
              - 'recoveryenabled'
              - 'no'
    condition: all of selection_*