bcdedit.exe or bootcfg.exe executed and safeboot registry keys modified

Sam Harrison@sect0rcybersec

•updated Aug 21, 2026•25•0•32

Detects when bcdedit or bootcfg is executed and Safeboot registry keys modified within a specified time window