Safe Mode Network Persistence via SafeBoot\Network Registry Key Write
Detects modifications to the Windows Registry keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network. These keys control which services or drivers are permitted to load during Safe Mode with Networking. Unauthorized changes to these keys can be used to ensure malicious drivers or services load during Safe Mode, providing a persistence mechanism that bypasses many security controls.
Microsoft Sentinel (KQL)
