Picus Security Highlights Attack Technique Used to Impair Defenses

Cybersecurity firm Picus Security has detailed a threat technique known as "Safe Mode Boot" (T1562.009 within the MITRE ATT&CK framework). This method allows adversaries to restart a compromised system into Windows' Safe Mode, a diagnostic startup state that loads only essential services and drivers. By doing so, attackers can effectively disable third-party security software, such as antivirus and endpoint detection and response (EDR) solutions, which are typically inactive in this mode.

The Safe Mode Boot technique exploits the intended diagnostic purpose of this Windows feature. While Safe Mode is designed to help users troubleshoot system issues by isolating problems, attackers leverage this reduced operational environment to bypass security controls that would normally detect and block malicious activities. This creates a window for adversaries to install malware or conduct other illicit operations without raising immediate alarms.

Picus Security's analysis explains how adversaries employ this tactic, providing real-world examples. The report specifically mentions the RA World ransomware, which in March 2024 was observed enabling Safe Mode with Networking by creating a service that modified system registry keys. Adversaries can also manipulate the system's Boot Configuration Data (BCD) to ensure Safe Mode with Networking is invoked upon restart.

Understanding this defense evasion technique is critical for organizations seeking to enhance their security posture. By recognizing how attackers might exploit Safe Mode Boot, security teams can better prepare their defenses and implement monitoring strategies to detect such bypass attempts.