blue-team-tools/rules/windows/process_creation/proc_creation_win_bootconf_mod.yml

title: Modification of Boot Configuration
id: 1444443e-6757-43e4-9ea4-c8fc705f79a2
status: test
description: Identifies use of the bcdedit command to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
  - https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html
date: 2019/10/24
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    Image|endswith: \bcdedit.exe
    CommandLine|contains: set
  selection2:
    - CommandLine|contains|all:
      - bootstatuspolicy
      - ignoreallfailures
    - CommandLine|contains|all:
      - recoveryenabled
      - 'no'
  condition: selection1 and selection2
fields:
  - ComputerName
  - User
  - CommandLine
falsepositives:
  - Unlikely
level: high
tags:
  - attack.impact
  - attack.t1490