Boot Recovery Tampering via BCDEdit
This rule detects the use of the Windows Boot Configuration Data Editor (bcdedit.exe) to modify system recovery settings. Specifically, it looks for attempts to disable recovery features or instruct the boot manager to ignore failures. Such modifications are common in ransomware and destructive attacks to prevent users from using Windows recovery tools to restore the system or access backups.
Sigma
