Esc

Safe Mode Boot - T1562.009

(ATT&CK® Technique)

Definition

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1562009["Safe Mode Boot"] --> |disables| EndpointSensor["Endpoint Sensor"]; class T1562009 OffensiveTechniqueNode;
        class EndpointSensor ArtifactNode; click EndpointSensor href "/dao/artifact/d3f:EndpointSensor";
        click T1562009 href "/offensive-technique/attack/T1562.009/"; click EndpointSensor href "/dao/artifact/d3f:EndpointSensor"; T1562009["Safe Mode Boot"] --> |disables| SystemConfigurationInitDatabaseRecord["System Configuration Init Database Record"]; class T1562009 OffensiveTechniqueNode;
        class SystemConfigurationInitDatabaseRecord ArtifactNode; click SystemConfigurationInitDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationInitDatabaseRecord";
        click T1562009 href "/offensive-technique/attack/T1562.009/"; click SystemConfigurationInitDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationInitDatabaseRecord";                          SystemInitConfigAnalysis["System Init Config Analysis"] -->
          | analyzes | SystemConfigurationInitDatabaseRecord["System Configuration Init Database Record"];

          SystemInitConfigAnalysis["System Init Config Analysis"] -.->
            | May Detect | T1562009["Safe Mode Boot"] ;
          class SystemInitConfigAnalysis DefensiveTechniqueNode;
          class SystemConfigurationInitDatabaseRecord ArtifactNode;
          click SystemInitConfigAnalysis href "/technique/d3f:SystemInitConfigAnalysis";            RestoreConfiguration["Restore Configuration"] -->
          | restores | SystemConfigurationInitDatabaseRecord["System Configuration Init Database Record"];

          RestoreConfiguration["Restore Configuration"] -.->
            | May Restore | T1562009["Safe Mode Boot"] ;
          class RestoreConfiguration DefensiveTechniqueNode;
          class SystemConfigurationInitDatabaseRecord ArtifactNode;
          click RestoreConfiguration href "/technique/d3f:RestoreConfiguration";

json