MITRE ATT&CKtechnique

T1688 Safe Mode Boot

Published 2026-04-14 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Defense Impairment
Platforms
Windows
Version
1.0
Created
2026-04-14

Description

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot. Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings. Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. Modify Registry). Malicious Component Object Model (COM) objects may also be registered and loaded in safe mode.

Related

Tactic · MITRE ATT&CK (1)

  • TA0112 Defense Impairment tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1054 Software Configuration mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (7)

  • S1247 Embargo software (malware)
  • S1242 Qilin software (malware)
  • S1212 RansomHub software (malware)
  • S1202 LockBit 3.0 software (malware)
  • S1070 Black Basta software (malware)
  • S1053 AvosLocker software (malware)
  • S0496 REvil software (malware)

Referenced by Compliance · mitigates (1)

  • CIS-18.3 Remediate Penetration Test Findings CIS Safeguard v8.1

References