Compliance Node Overview
MITRE ATT&CK T1688 (Safe Mode Boot) is an Enterprise Defense Impairment technique. Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot. Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings. Adversaries may also add their malicious applications to the list of minimal services t... Affected platforms: Windows. ATT&CK-mapped mitigations: M1054 Software Configuration, M1026 Privileged Account Management.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1688/
SHA-256 integrity: 5822c0a4d6bbe36d7b4a1d5b7668c3a0ca66d0d1ee44b922a7a28524314db72a
Primary Citations — 6 traced to source
- MITRE ATT&CK Technique T1688: Safe Mode Boot (https://attack.mitre.org/techniques/T1688/)
- MITRE ATT&CK Tactic TA0112: Defense Impairment (https://attack.mitre.org/tactics/TA0112/)
+ 4 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
⚠ Important: Human Verification Required
Bidda compliance nodes are reference intelligence, not legal advice. Every node must be reviewed by a qualified compliance professional or legal counsel before implementation in any enterprise workflow, regulated system, or compliance programme. See bidda.com/disclaimer for full terms.