BCDEdit Failure Recovery Modification
Hypothesis and description
This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery.
- Platforms
- Windows
- Domain
- Analytic
- Subtypes
- Process
- Submitted
- 2021-05-11
- Contributors
- Splunk Threat Research <research@splunk.com>
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1490 Inhibit System Recovery | Impact | Moderate |
1 technique. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
PseudocodePseudocode - detect attempts to add a certificate to a certificate storeData model: CAR native
Pseudocode implementation of the splunk search below
processes = search Process:Create
bcdedit_commands = filter processes where (
exe = "C:\Windows\System32\bcdedit.exe" AND command_line="*recoveryenabled*" )
output bcedit_commandsSplunkSplunk codeData model: Endpoint
You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. Tune based on parent process names.
| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.userAcross MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.